as they need session validation