#28 checking user model in session to secure authentication