[SECURITY] ~pos manager are allowed to write and create session