Controllers refactored to use the API.

- Moved session handling into its own class.
- A LOT of TODO comments added
- Refactored the 3 controllers

Due to the state of the codebase, I'm not sure if any of this works.