Move otpoll to session controller
Send Json content-type to avoid guessing