add validation for user session