Whitelisted params for session controller.