Moved User validation to from __loadPermissions() to checkPermissions() and fixed Session paths