anchor.diff:          CartConst.SESSION_EXPIRES_KEY: expires.millisecondsSinceEpoch
       };
       CartSystem.instance.session = session;
  -    return (new File(CartConst.CONFIG_SESSION_PATH)).writeAsString(decoder.convert(session));
  +    return PinUtility.writeJsonFile(CartConst.CONFIG_SESSION_PATH, session, withIndent: true);
     }
   
     static Future<File> _removeSessionToken(HttpContext ctx) {
       _setCookie(ctx, CartConst.SESSION_TOKEN_KEY, '');
       CartSystem.instance.session = {};
  -    return (new File(CartConst.CONFIG_SESSION_PATH)).writeAsString(JSON.encode({})).catchError((e, trace) {
  -      PinUtility.handleError(e, trace);
  -    });
  +    return PinUtility.writeJsonFile(CartConst.CONFIG_SESSION_PATH, {});
     }
   
     static void _setCookie(HttpContext ctx, String name, String value, {DateTime expires: null}) {
  
positive.code: 
    static Future<File> _updateSessionToken(HttpContext ctx) {
      String token = PinUtility.uuid();
      final decoder = new JsonEncoder.withIndent('    ');
  
      var expires = new DateTime.now();
      expires = expires.add(new Duration(seconds: CartSystem.instance.setting['cookieLive']));
  
negative.code:       if (!isAuthed) {
          // add oauth owner email, and save the credentials first, since google api request need them
          credentials['email'] = email;
          return PinUtility.writeJsonFile(CartSystem.instance.oauth['web']['credentialsFilePath'], credentials, withIndent: true);
        } else {
          // validate is valid owner or not
          if (email == CartSystem.instance.credentials['email']) {
  