changed session controller to use form_tag instead of form_for