Yeah, the JSON view that gets actual transaction data checks the session