Various small changes to enable sessions to work correctly, so now tests to verify permissions enforcement can proceed