check session: only session->access_token.