Moved all the fake user logic to the secured controller, as we need a fake session too now that the frontend wants to understand users and sessions.