Saving _id, username and group on session auth
Added permissions checks and relative tests