Karin's approach is good; the Civi-native way (in case you're not on Drupal) is to use Price Sets for sessions. This is covered in the Complex Event Fees section of the CiviEvent documentation. They're very configurable, and allow you to set per-session limits, additional costs for some (or all) sessions, and more.
If you go this route, install the ...
Seems like a known issue which recently got fixed in webform civicrm. Can you try applying the patch https://github.com/colemanw/webform_civicrm/pull/180 or use the latest 7.x version from github and see if it fixes this problem for you?
We use Webform CiviCRM modules for this:
Sessions are custom CiviCRM fields on the Partipant entity and Webform Select Limit module lets you put limits on how many participants can select a certain Session.
I'm not sure from your description how exactly your form is configured. For the update participant status you may need a second form and specific url to reach it which includes the user's contact id and the event id.
See the responses to this question for more (and clearer) details:
How do I get Retrospective feedback for an event using a Webform (...
I finally solve the problem by doing this:
1- desable properly webform module and uninstall it.
2- desable properly webform civicrm integration and uninstall it.
And i reisntall the both module and flush all caches. And i have the civicrm tab now
Technically it's the permission "access all cases and activities" that can add roles on Manage Case but I guess that's the same as "site admin"/"full access" in your setup. The reason seems to be to avoid a loophole where access to cases could be granted that shouldn't be (see https://civicrm.stackexchange.com/a/33409/181).
Anyway what you might be able to ...