session form now uses form_tag