Merging the permissions directly into the session hash now - to avoid nested hashes.