validate session with the old REST API