IAuthenticator-implementing classes must now offer access to the session via the session() method.