Check session key and signature