Sessions are HMAC-signed and expire automatically after 12 hours.