Fix old typo; be more consistent about injecting the framework

This restores the original session key value (to what it was in the 1.x stream) - which no one seems to have noticed!

It also injects the framework into "all" controllers in a more consistent manner.