[session] move context manager logic in the security context manager The `init_security` and `reset_security` method have no other user that the context manager itself. Having dedicated public function is not useful.

<div id="ajaxroot">
  <div class="ajaxHtmlHead">
    <script src="http://foo.js" type="text/javascript"> </script>
  </div>
  <h1>Hello</h1>
</div>