allow read-only session