HTTP::Session2 use the secret token as 'data'. it uses session ID as a 'key'.

Previous version uses session-id as a 'data'. It uses 'the secret' as a 'key' for HMAC.
But @kazuho-san says it makes secure if you swap data and key.
It's secure if leaked 'the secret'.