refactor to not interact with session from controller and view