check if session has this question and throw unauthorized exception if
not