Move responses from Middleware to own class
Don't set the full PDF path in the session

The complete path to the PDF being rendered is being set in the session, making this path visible to the public.

Now only the PDF filename is being set in the session.
Move conditions and condition validations to own classes