Moved session creation to the login() method in the Controller