docs: function requireValidSession (session) {
      assert.ok(session && typeof session === 'object' && typeof session.sessionId === 'string' && Array.isArray(session.roles), 'session with sessionId and roles required to request access')
  }