Proper session handling done. HasValidSession checks user is managed.