security: add opaque userdata pointer into security session