API require explicit initiation and injection of session key parameter

Moved this into HybridSessionStore