check for use agent to prevent session stealing