a little bit safer is_session_valid