session checking and api handler