The sessions.bats tests were seeing some flaky behavior when listing sessions but not getting the expected amount back. This is due to the connect_nc command that is currently used, which will immediately set the session to be "canceled" once it returns. This can cause subsequent operations to get unexpected results (sometimes, listing sessions would return an empty list if the created sessions go to a "terminated" state).
* Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed.
* Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing.
* Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.
Michael Li
Jeff Mitchell