[SECURITY] ~only pos managers can create and modify pos sessions