session for user only in file index.php we need validation in all controllers