added permission with session
forbade manage pages without session