starts on controller_base.rb
finishes redirecting, and starts on sessions/cookies