create new check login session check permission
include check login session (but comment // not used)