enforce verified session