Your controller should be passing the session state to the model (passing the items needed from session state for the model to manipulate data). Models should

Your controller should be passing the session state to the model (passing the items needed from session state for the model to manipulate data). Models should have no concept of a session. They should be almost entirely self-contained. Controllers should do only basic validation (length, format, etc.)