web client authorization, checking active session and that character belong
to session user