Move session manipulation out of login model