LobbyController

use user from DAO object, not user session attribute