changes in Controllers

access by Attribute, deleting sessions