fix session logic, add logic to controller