http://www.xiting.ch/en/security-blog-detail-en/fast-navigation-between-pfcg-su01-and-some-other-tricks.htmlYou are being confused by the difference between starting a transaction from the session_manager and using ok-code commands within the application which offers forward and backward navigation.
One of my colleagues wrote a blog about this recently as it can be confusing but is actually a very nifty thing to know about -> Fast navigation between PFCG, SU01 and some other tricks - Xiting AG - EN
How to resolve it is that you do not authorize the user for PFCG in your example. The Tcode is checked before the navigation call.
Cheers,
Julius