diff --git a/vaadincreate-ui/src/main/java/org/vaadin/tatu/vaadincreate/VaadinCreateUI.java b/vaadincreate-ui/src/main/java/org/vaadin/tatu/vaadincreate/VaadinCreateUI.java
index 0ad0f87..a76d122 100644
--- a/vaadincreate-ui/src/main/java/org/vaadin/tatu/vaadincreate/VaadinCreateUI.java
+++ b/vaadincreate-ui/src/main/java/org/vaadin/tatu/vaadincreate/VaadinCreateUI.java
@@ -54,7 +54,6 @@ public class VaadinCreateUI extends UI implements EventBusListener, HasI18N {
     // in the unit tests included. Supposed these were the real production
     // services this UI can be extended and getters for the services overriden
     // for creating test UI for unit tests.
-    private AccessControl accessControl = new BasicAccessControl();
     private transient ProductDataService productService = ProductDataService
             .get();
     private transient UserService userService = UserService.get();
@@ -127,7 +126,7 @@ protected void showAppLayout() {
                 VaadinIcons.USERS, AdminView.VIEW_NAME);
 
         Product draft = getProductService()
-                .findDraft(accessControl.getPrincipalName());
+                .findDraft(getAccessControl().getPrincipalName());
         if (draft != null) {
             handleDraft(draft);
         } else {
@@ -148,7 +147,7 @@ private void handleDraft(Product draft) {
                 .navigateTo(String.format("%s/%s", BooksView.VIEW_NAME, id)));
         dialog.addCancelListener(e -> {
             logger.info("Draft discarded");
-            getProductService().saveDraft(accessControl.getPrincipalName(),
+            getProductService().saveDraft(getAccessControl().getPrincipalName(),
                     null);
             getNavigator().navigateTo(target);
         });
@@ -165,6 +164,11 @@ public static VaadinCreateUI get() {
      * @return Instance of AccessControl
      */
     public AccessControl getAccessControl() {
+        var accessControl = getSession().getAttribute(AccessControl.class);
+        if (accessControl == null) {
+            accessControl = new BasicAccessControl();
+            getSession().setAttribute(AccessControl.class, accessControl);
+        }
         return accessControl;
     }