update Controller use Session, not Cookie