1. If the users enter /example1/home.xhtml there is no session id to validate. Not sure what you mean here.
2. Your example looks good. The only thing I would like to mention is that you typically have to use a simple data type like String for the validation. This string would be the session id value in your case. Now you just have to check if the session id is valid or not and return true or false.
Do you play Magic?
Get TopDecked MTG, the #1 Magic App, built by players, for players. Free to use, forever.