It looks like most of this logic could exist as a pure ruby object that doesn't know anything about session or params. This would make it much easier to test.