session-info: check if session belongs to user