[auth] should keypair be locked per session?

[rt2zz]

Options:

1. store pub key in session
2. get rid of sessionId and always use pub key
3. allow keypair to change at any time, sessionId is the fundamental key

from a security standpoint I think all options are roughly equivalent but one of these options probably makes the code the simplest, and I am guessing the extra constraint of using pub key as sessionId will be useful moving forward