Moved SecretNumber session handler to controller