Yep.  The session check should always be the first line in a function if it is being used.

On the same note, you don't need to define `$this->app` in a JControllerBase child unless you're overriding the default return from `JFactory::getApplication()` since the JControllerBase constructor will load that and `$this->input`.