session taken from request as before not injected from spring