A server-side session store backed by any doido_cache::CacheStore: only
the session id travels in the cookie, while the data lives in the cache
(memory/redis/memcache). This is the generic backend the spec’s
DbSessionStore/RedisSessionStore specialize.
The default, stateless session store: the whole session is serialized into a
cookie value and signed with HMAC-SHA256 so it cannot be tampered with. The
cookie value is base64url(payload).base64url(signature).
The default cookie session store used by Context::session: the whole
session is serialized and encrypted with AES-256-GCM (via
doido_core::crypto) into the cookie value (base64url of
nonce || ciphertext+tag). Unlike CookieSessionStore, the payload is
hidden as well as authenticated (spec 07).
Pluggable server-side session persistence. The cookie store keeps all state
in the signed cookie itself, so its load decodes that cookie and save is a
no-op; database/redis stores (see the session-db/session-redis features in
the spec) key server-side rows by the session id.