Factor out session extraction code to session_engines
Add timeout for XDomain session extraction
Refactor Session