Move the session to be a private attribute