add user session validation and flash message for invalid login and unauthenticated access