- prevent client from creating a session server-side with any id (expired or invalid sessions are replaced with a new session id), same as Rack::Session::Dalli::get_session().
- also fulfills requirement of base Rack::Session::Abstract::ID that get_session() is supposed to create new session when sid=nil