Security: block resuming session from other users.
Verify ownership in SessionManager.session
Raise Unauthorised error on session hijack attempt.