I think that saving string is more safe than class, because string will always be a string. A custom class does not have to exist in environment where you load the session. Let's suppose you want to inspect content of session that is marshaled. You call something like `Marshal.load(Base64.decode64(CGI.unescape(string).split('--').first))`. If you run this in irb session without rails environment you will probably encounter undefined class/module exception when loading a marshaled string.

But if you think it's ok to store classes, I can update. It's not so important for me.