Removed username as request parameter, storing details in session