The session is passed in to the request handler