should be rejecting by default until actual session checking is in place