Stash the user's key in the session, protected by an in-memory key
(the idea being that the on-disc session entries are useless without
the key).