Every Java web application framework built on top Servlet, the framework provides a Front Controller Servlet which intercepts all incoming requests and delegates to Page Controllers/Actions, and then the Controller/Action forward to View.
This is where the biggest misunderstandings and mistakes typically occur. None of the popular MVC-based web frameworks address a Model or provide a container for writing Model business logic. Action objects or Page Controller objects are still part of the Controller. They are the extensible elements of the Controller that are customized and developed for a specific application. They work with a "servlet" object that usually comes with the framework. In a Struts-based component, all of the objects that are created from the struts-config.xml file are Controller objects, for example.
The correct execution path is View -- Controller --
Model -- Controller -- View. How does the Controller know how to communicate with the Model? You write custom Controller Action classes.
In terms of "session" related information, if it is HttpSession related data, then it could fit in well in a Http-based Controller, e.g Action classes/objects. However, if it is another type of "business-oriented" session data, then it would be coded in Model (or Business tier).