[session] security context directly use transaction object when applicable Most of the security logic have been moved on Transaction anyway.