Use handler->HasPermission() instead of handler->GetSession()->HasPermission()