use Session object instead of SessionUtil in 1.3.6