I'm weary of client-sessions past version 1.0.0, suggest we test extensively (expired sessions, sessions encrypted with a different key, etc)