fix session check for edit/destroy