[security] The contract needs to enforce permission restrictions when creating a session.

[wow-sven]

For instance
Create a new session, replace the auth key, transfer.

If a DApp behaves maliciously, it can circumvent the restrictions imposed by the SDK and manipulate the permission information presented to users. In such a scenario, a session key could potentially obtain access to all operations. Our aim with sessions is to prevent repetitive authorizations, rather than bestow super permissions.

If modifications are required here, it's necessary to thoroughly review all permissions and contract adjustments and then update the SDK.