Fixed how session validation works, how set in headers