Made session management a bit more extensible.

This will make it easier for learners to add CSRF protection.