ACL and session