Use a constant for the two usages of the session variable.
Split authentication API into its own controller.
Unit tests!