Using parameterized queries. Move some code from login controller to index controller.
Now there is a user entity object stored in the session that corresponds to either an Employee or Patient.