The controller is responsible for grabbing out those parameters and asking the MVC framework who the current user is (and possibly do things like grab data from session state).