Would it make sense to attach the ``SessionContraints`` directly to the ``Session`` object? It seems like there is basically a 1-to-1 mapping between these, and I can't think of any good use cases at the moment when we would want one without the other.

This would also save the ``sessionConstraints`` parameter needing to be re-injected into each new controller class, reducing the amount of change in this patch slightly.