Move session code to controllers, outside from User class

A lot of controllers were using 'user' to manage the current session.

These are the first steps to move it to better places.