lock out user if there session is borked