get session properly (SessionAware way)