[fix] api closed for unauthorized
[fix] check existing user in session before lock order
Bump version
Merge branch 'release/1.2.0' into develop