Original fictional app. Use the supplied roles and row as a model.

Browser
Shows the page. It can hold a JSON object the page received or edited.

Server
Receives the request, reads the session, and decides access.

Database row, stored with the server
id n4
role member

Session
The server stores the session.
The cookie holds the identifier lab-sid-04.
The identifier is sensitive on a real system. This value is fiction.
The cookie does not hold the role.

Browser object
response.json claims a different role for the same id.

Check: the stored role is member.