check for valid session token in necessary requests