exposed the appsession instantiating as protected virtual  method