add app/session ACL