SECURITY: Prefix session key and validate token format.