add: validate session before supplying an img

main.py

@@ -1,6 +1,13 @@
 from fastapi import FastAPI
 
+# use database residing here
+DB_LOCATION = (
+    "../testbox/photovoter.dblite"  # Q: any allowances for this being not OUR database?
+)
+
 app = FastAPI()
+con = sqlite3.connect(DB_LOCATION)
+cur = con.cursor()
 
 
 @app.get("/new_session")
@@ -11,9 +18,21 @@ async def new_session():
     return {"session_id": 42}
 
 
-@app.get("/next_picture/{session_id}")
-async def next_picture(session_id: int):
+@app.get("/next_picture/{cookie}")
+async def next_picture(cookie: int):
     """Request new picture to rate."""
+    # check if the cookie is valid
+    cur.execute(
+        """SELECT sessionid 
+            FROM sessions 
+            WHERE cookie = :cookie
+            LIMIT 1""",
+        {"cookie": cookie},
+    )
+    sessionid = cur.fetchone()
+    if sessionid is None:
+        return
+
     # take not rated picture from the database
     # do not insert anything in the database yet
     # return this picture