Simple session tokens are fine, always have been.