Moved storing the startTime to Session so that it can't be hijacked in the form.