Pass the session to the controller's last_request_update_allowed?