constructor injection needed because the session object is already needed in the constructor