backend: add session validation check