Yea for sockets, you should not be using session verification I think. You can initiate a socket connection after verifying a session, but the connection itself can be trusted