WIP: Add session hash and remote CCS

PR so this can be reviewed.
give it a full name: "handshake master secret"