Restrict session state change operations to session creator