def allowed_for_local_cluster(session, action)
  pcs_config = PCSConfig.new(Cfgsync::PcsdSettings.from_file('{}').text())
  return pcs_config.permissions_local.allows?(
    session[:username], session[:usergroups], action
  )
end
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.