POJOs are now being passed through Session and not through URL params