check username in URL against session-username