Moved session.inc.php into session mgmt and xss token mgmt into controller