I don't think this should be a config. Session data is inherently transient, so we should just be able to recognise invalid sessions and discard them. Even if we decide to version the session format, the version we're expecting should be a constant in the code rather than a config variable.