Now removing/adding picodata login privilege only removes/adds tarantool usage. And the functionality of taranool session is implemented by our custom check in on_auth trigger.
After rebase on top of mr introducing pico service user, some fixes related to this user were also added.