WIP: Add session hash and remote CCS

PR so this can be reviewed.
"protected using keys derived from the handshake master secret"