Introduced the securityPolicy member of the Yesod typeclass, added tests...

..., and updated documentation and scaffolding
Yeah, you're basically choosing between: 
A) Require folks that are customizing makeSessionBackend beyond just changing the keyfile path to make lockstep changes
and
B) Require folks using the typeclass defaults or the default scaffolding to make lockstep changes