added status401 on session GET if no session found (or session invalid)