different implementation for filtering roles and permissions in session