validate_session: check for user agent