Use session store rather than cookies.

I naively thought that setting a session secret would encrypt the
cookie. That's not the case.