Session based access control in geographically replicated Internet services