* make session key generation more unique
* add tests for it