fixup: session: Add API to set the allowed caps