Add permission into session