Better store session-meta-data in `session` object

[BracketJohn]

Improve the story of storing id and createdAt within the session object.

E.g., we could add read-only copies in, so that overwriting it leads to no changes in session at all.