executeOnAll must check implicit session authentication, too