add_to_cart does not check session

  def add_to_cart
    @cart = find_cart
    product = Product.find(params[:id])
    quantity = params[:quantity]
    quantity ||= 1
	  
    if quantity.to_i > product.quantity.to_i
	logger.info "This product only has #{product.quantity.to_i} remaining."
	render :nothing => true, :status => 400 and return
    else	  
      @cart.add_product(product, quantity.to_i)
      show_cart and return
    end
  end