I find the choice of "Session" as the name for everything in auth pretty confusing, especially as it stores things in the Controller.Session