There are plenty of cleanup opportunities that have been idle for years. However, one of the problems that persists, and in some ways stymies cleanup, is the use of the session as an effective global variable bag throughout the large velocity Action classes.
I propose some general refactoring with the goal of reducing and eliminating this spurious use of session state in view. There will certainly be some items that are not strictly related, but seem ripe to handle as broken windows. The main priority will be decomposing the giant classes into smaller ones with explicit dependencies and test coverage, such that changing the current, highly coupled implementation without breaking it becomes tractable through careful extraction. This should ease other, standing cleanup needs for the long term as well.