if (!authenticate($session)) { ...