[FIX] pos: check constraint on session instead of uid (eg: runbot import demo data with uid=1 but other user_id