Changed implementation to explicitly use httpsession