fixed controller.session and controller.user