implements a more secure in-process session state provider; see also ref #49