fixes #631: removed usage of session.controller in cookie session store