Wondering if this would be neater as `buckets_available = app.permissions.buckets_in_sessions(session)` and pushing the session and user-is-logged-in logic into the permissions class.