redirect to 404 when the client is not the session