correct query + permission for managesession and createsession page