small tweak to header response
added session validation for getusers route