Couldn't an attacker use successive requests to set an arbitrary amount of different variables, i.e. 'adhocracy_session_{1..1000000}' that get stored on the server causing it to run low on memory?