add Session::id() and return null if session validate fail