select by id, add session checking