check session and login in authorize request