proper check for session middleware