index.php checks for sessions access_token instead of auth