only check for session hijacking on requests that have valid sessions.