title: Can Sessions be manipulated by the user clientside?
body: <p><strong>Background story:</strong> We run a website with thousands of users and a handful of admins. Some of these admins don't need all-access to the website, so I want to restrict their access by giving them individual permissions.</p>
  
  <p>My plan is to set a Session on user login with the users perimissions, if given any. However, I'm concerned that this might be an unsafe action.</p>
  
  <p>Can a Session be manipulated by a user client side? In this case a regular user could gain access to the admin features if they knew the permission names and set a Session for themselves.</p>
  
  <p>I found some related questions on Stackoverflow, but they didn't give give me enough information on the subject.</p>