solved it by removing
<identity impersonate="true" password="" userName="" />
The code works in a brand new project without any authentications(windows authentication: off; anonymous authentication on ).
While I integrated the same code to a windows authentication web application, it has errors of "WinSCP.SessionRemoteException: Request event
System Error. Code: 5.Access is denied"
I would like to show you the log but do not know how to get it.