fixed to use string params instead of session hash
fixed to use qstring params