filter change

moved account check into session auth filter, where it should've been to
begin with