hmm, doesn't this mean that in the context of a controller, `session` is one thing ( a hash) and `self.session` is another (a user object).  that seems highly confusing.