API require explicit initiation and injection of session key parameter

Feels a bit enterprisy - can you give an example of where you'd want to override this, but still call `HybridSession::init()`? Seems like `HybridSessionStore::init()` (or `SomeOtherSessionStore::init()`) would be fine, since there's a static call here anyway.