verify session before creating