Session verification endpoint