use session module instead of session api directly.