make sure session key dont start with '_'

@see https://github.com/koajs/userauth/pull/5