Fix security issue , if session not set, the $authkey will be bypassed