:bug: Fix missing permitted username in sessions controller