fix DEFAULT_PERMISSIONS access if we have no PERMISSIONS key in session yet
extend docs about running with a non-default / local configuration