session managed via injection