security: don't share session keys, bind connections to users via a secret session key