session validation done in all the controller