use HMAC digest to sign messages instead of cleartext key...
use HMAC digest to sign messages instead of cleartext key
also some cleanup of Session code
security doc updated as well.
Buffers do not get digested, so large (non-copying) messages should not
cause performance to suffer too greatly.