set session in controller