session: verify authorization of root page