fixed sessions HQ versus session APP in the routes and controller