Currently, anyone with server access to the db can enter data into any session. Making this issue so I don't forget to block it.