Provides a totally random session identifier. If you need issued-id validation, supply a custom SessionProvider.