1) Updated user-device relationship to bidirectional, owned by device.

2) Store user id in session instead of user object.

3) Updated relations to eager fetching
Hide share button for non-admin and non-manager user. Hide other buttons too, not just disable