Sorry for adding this comment late, but this could be made read-only

If I recall correctly this was by design, so we can modify one session in in-memory cryptoStore (see line 74) without updating the entire object.

If you still think it's better to make this read-only and update rest of the code I can put up a diff

Thanks for explaining! Looks like it's been thought through, so it's fine to leave as-is