even when it's "session state", it's nothing more ...

# server

[dave]

even when it's "session state", it's nothing more than an encrypted serialised JSON object of identifiers. I wouldn't store anything complex or mutable in there.