The problem is that we keep copy of role permissions in each session which is a waste of db badnwidth, instead we could keep it in serialised file or shared memory. All we need in session is a list of users roles, the rest is the same for all users.