ARCHE-306 use session instead of request since the attr is stored on the session. Thx Bert for spotting!