refactoring ValidateSessionAttribute to allow IEnumerable list of abilities