[session] allow users to update own session;