added checkSessionToken middleware