docman: fix session permission check