move generation of session key to preauth hook.