Change algorithm a bit for empty keys to make it easier testable
Add a bunch of session id / session encryption tests from Ben.