You should check both session != null && userId != null, because only if both are true your user is authenticated. Think your self how to reorganize code to check this.