fix Http session injection and make Http response object injectable