fixed several permission and session-related issues