Should we store session privileges in python shelve or as session variables?
I recommend take a look at NoSQL storage engines like Memcached or Redis.
They give you several advantages:

Place at a separate machine, so if you need to scale your app you'll be able to do it.
Extra interface to check what is stored in them.
Ability to flush if you really need once.
You can connect other apps to the these programs, so you can share sessions across several apps (however it's not recommended for big fast developing apps and keeping complicated structures).
Writing a web based flask api application with several modules. I would like to incorporate different permissions and privileges for different user logins for the different modules. Query is whether these privileges should be stored as session dictionaries or as shelve values? Which is more efficient and faster? Why would there be a preference of one over the other in this context?