Added missing check for user in session