restricted publishing ability with session variable