add option which defaults to true to check requests which do not have an
existing session, also add overall enabled flag