Move session ID encryption, decryption & validation to SessionRefCipher.