check session on application authorization