ValidateSession is now more secure : check if the user exists in DB.
(For example if user has been deleted in the mean time)