defines session on controller constructor, retains without passing as an arg