I only need to know what they key the session on, what the intended use of the class is. If it is in the 'machinery', it would make a third base of session identification. If I 'get' the SessionBindingObject - and store it alongside other keys I already have working, I intend to see if my stored copy matches the key that the server is working off of and just skip off to a simple meaningful html feed if several verificatons do not match up.
IOW - look normal unless the client shows some
patterns that I am expecting to see. Perhaps keep fifteen or twenty 'sessions' disentangled in a multi threaded senario is a reasonable description of what I have in mind.