added session validation for getusers route