add session2 (the stateless session object) implicit variable
add secretkey sensor, csrfcheck shall be load after session intialized