More work on session security.