check for null header values for session token