I think the store needs to return `sid, session`. Because there is a chance the sid is invalid and the store should be able to invalidate it.