some comments about protecting ksession and localTaskService