code to display is managed outside server execution context
refactoring on code to display/to add
sessionId is secured