fix session issues:

- Store session data immediately on create.
- Check __session_support availability
- Added CSRF helpers.
added check function for response being closed or not.
added safe_html for escaped html strings.