Session ACL is "Public RW" while its protected

New Issue Checklist

• [x ] I am not disclosing a vulnerability.
• [x ] I am not just asking a question.
• [ x] I have searched through existing issues.
• [ x] I can reproduce the issue with the latest version of Parse Server.

Issue Description

ACL for the Session class says Public Read and Write for all rows which is confusing for developers.

Parse docs explain that ACL should be set to a role or a user id in order to be protected.

Session Class seems to be protected under the hood but the UI says Public Read and Write in the ACL column which we should fix.

Steps to reproduce

Spin up a server and login a user.

Actual Outcome

All rows in Session class has ACL set to "Public Read and Write"

Expected Outcome

Environment

All rows in Session class should have ACL set to userID

Server

• Parse Server version: latets
• Operating system: mac
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): local

Database

• System (MongoDB or Postgres): mongo
• Database version: not sure
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): local

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): JS
• SDK version: latest

Logs

Start by reproducing the issue in the Parse Dashboard after spinning up a server and logging in a user, then inspect how the Session class ACL is displayed. The fix is done when protected Session rows no longer appear as “Public Read and Write” in the ACL column while retaining their underlying protection.