session check before middleware