This seems inconsistent with line 14: perhaps rename it to `HASH_SESSION_KEY` ?