FEATURE: session and cookie validation