refactor(session): simplify permissions event