applied sessions in controllers