Add optional custom session token

This is a PR that allows for a custom session token. Currently, there is no way to use anything except for node's `crypto` module for generating a user's session token.

My use case is that during security evaluation, we felt more comfortable with using an already vetted source (e.g. `/dev/urandom`) for generating our random bytes.