In the docs, refer to the public object as a "session" instead of a
"session handle".
Also make the session available in publish functions.
Merge branch 'session-hooks' into hash-login-tokens