diff --git a/src/Controllers/Common/ContentController.cs b/src/Controllers/Common/ContentController.cs
index 6aefa1d..0ea302b 100644
--- a/src/Controllers/Common/ContentController.cs
+++ b/src/Controllers/Common/ContentController.cs
@@ -56,27 +56,19 @@ public class ContentController : Controller {
     [HttpPost]
     //[Produces("application/xml")]
     [Route("ContentWebService.asmx/GetProduct")] // used by World Of Jumpstart
-    public string? GetProduct([FromForm] string apiToken)
-    {
-        Viking? user = ctx.Sessions.FirstOrDefault(x => x.ApiToken == apiToken)?.Viking;
-        if (user is null)
-            return string.Empty;
-
-        return user.ProductData;
+    [VikingSession(UseLock=false)]
+    public string? GetProduct(Viking viking) {
+        return viking.ProductData;
     }
 
     [HttpPost]
     //[Produces("application/xml")]
     [Route("ContentWebService.asmx/SetProduct")] // used by World Of Jumpstart
-    public string? SetProduct([FromForm] string apiToken, [FromForm] string contentXml)
-    {
-        Viking? child = ctx.Sessions.FirstOrDefault(x => x.ApiToken == apiToken)?.Viking;
-        if (child is null)
-            return string.Empty;
-
-        child.ProductData = contentXml;
+    [VikingSession]
+    public string? SetProduct(Viking viking, [FromForm] string contentXml) {
+        viking.ProductData = contentXml;
         ctx.SaveChanges();
-        return child.ProductData;
+        return viking.ProductData;
     }
 
     [HttpPost]
@@ -362,12 +354,8 @@ public class ContentController : Controller {
     [HttpPost]
     //[Produces("application/xml")]
     [Route("ContentWebService.asmx/GetAvatar")] // used by World Of Jumpstart
-    public IActionResult GetAvatar([FromForm] string apiToken) {
-        Viking? viking = ctx.Sessions.FirstOrDefault(e => e.ApiToken == apiToken)?.Viking;
-        if (viking is null || viking.AvatarSerialized is null) {
-            // TODO: result for invalid session
-            return Ok();
-        }
+    [VikingSession(UseLock=false)]
+    public IActionResult GetAvatar(Viking viking) {
         return Ok(viking.AvatarSerialized);
     }
 
@@ -514,17 +502,8 @@ public class ContentController : Controller {
     [HttpPost]
     [Produces("application/xml")]
     [Route("ContentWebService.asmx/SetRaisedPet")] // used by World Of Jumpstart
-    public IActionResult SetRaisedPetv1([FromForm] string apiToken, [FromForm] string raisedPetData) {
-        Console.WriteLine(string.Format("\n{0}", Request.Path));
-        foreach (var x in Request.Form)
-            Console.WriteLine(string.Format("{0}", x));
-        
-        Viking? viking = ctx.Sessions.FirstOrDefault(e => e.ApiToken == apiToken)?.Viking;
-        if (viking is null) {
-            // TODO: result for invalid session
-            return Ok(false);
-        }
-
+    [VikingSession]
+    public IActionResult SetRaisedPetv1(Viking viking, [FromForm] string raisedPetData) {
         RaisedPetData petData = XmlUtil.DeserializeXml<RaisedPetData>(raisedPetData);
 
         // Find the dragon
@@ -665,7 +644,8 @@ public class ContentController : Controller {
     [HttpPost]
     [Produces("application/xml")]
     [Route("ContentWebService.asmx/GetCurrentPetByUserID")] // used by World Of Jumpstart
-    public PetData? GetCurrentPetByUserID([FromForm] string apiToken, [FromForm] string userId, [FromForm] bool isActive) {
+    [VikingSession(UseLock=false)]
+    public PetData? GetCurrentPetByUserID(Viking viking, [FromForm] string userId, [FromForm] bool isActive) {
         Console.WriteLine(string.Format("\n{0}", Request.Path));
         foreach (var x in Request.Form)
             Console.WriteLine(string.Format("{0}", x));
@@ -678,6 +658,7 @@ public class ContentController : Controller {
     [HttpPost]
     [Produces("application/xml")]
     [Route("ContentWebService.asmx/GetActiveRaisedPet")] // used by World Of Jumpstart
+    [VikingSession(UseLock=false)]
     public RaisedPetData[] GetActiveRaisedPet(Viking viking, [FromForm] string userId, [FromForm] bool isActive) {
         Dragon? dragon = viking.SelectedDragon;
         if (dragon is null) {
@@ -705,12 +686,8 @@ public class ContentController : Controller {
     [HttpPost]
     [Produces("application/xml")]
     [Route("ContentWebService.asmx/GetInactiveRaisedPet")] // used by World Of Jumpstart
-    public RaisedPetData[] GetInactiveRaisedPet([FromForm] string apiToken) {
-        Viking? viking = ctx.Sessions.FirstOrDefault(e => e.ApiToken == apiToken)?.Viking;
-        if (viking is null) {
-            return null;
-        }
-
+    [VikingSession(UseLock=false)]
+    public RaisedPetData[] GetInactiveRaisedPet(Viking viking) {
         return new RaisedPetData[0]; // FIXME should return real inactive pets list
     }