protect 500 when no session