update session permissions