Add permissions and fix session controller