added session objects
moved validation to the general app controller