In real MVC, you want to put everything related to your business rules, storage access, etc. in your model. Then you wrap the View and Controller around that as a very thin web <-> model glue. That's all a web framework should do, web-enable your model classes. Things that should not happen in the Controller include touching the ORM (or SQL queries), validating input, any business logic, etc. Just pass the request to the right model, see if the model did what you asked, and display the success page or the error page.

Here's a short talk I wrote on the subject:

http://www.jrock.us/fp2008/catalyst/start.html