check session key before reading it