Curve25519 function, scalar multiplikation
I got the answer now! Curve25519 does not have key validation. Usually you have a point $P =(x,y)$ on a elliptic curve $E$ over $F_p$. But there is not a point $P$ on the elliptic curve for every value in $F_p$. If you make a key exchange with such a system, you will get a point, or a x-Value (using Montgomery x-only computation). Now you have to test, wether the given point is on the elliptic curve or not, because you can't calculate with a point, thats not on the curve.
Now as i said Curve25519 does not have key validation, because it takes time. But the theorem (in which $X_0$ is defined, too) in the paper about Curve25519 that says, that there is a Point for every x-Value over $F_p$. So you don't need key validation!
The bottom line of is, that you only need the extension field $F_{p^2}$, because you don't want key validation.