FrontController: make Session an explicit parameter, remove Session-based wiring from Factory