Restrict user actions by session details using a validator