fixed permissions in session