sessions: allow session overriding via the `GetSession` hook.