User session acl fixed