Add access checking to sessions controller.