Um, why are you checking for session? Unless you’ve manually turned it off, a session will always exist for any connection. Even then, that’s not very good practice. You really should be doing something like:
if session[:user] … else … end
And as a side note, I don’t know what version of Rails you’re using but using the controller variables themselves (@session, @params, …) is deprecated. You’re supposed to use the methods instead (session, params, …).
Jason