remove if in controllers to verify user's session