Preface: I absolutely love Revel, and I hope to put something built on it into production very soon.

That said, I'd be hesitant to bring up Revel's session as a positive. It shoves everything into a cookie instead of using the cookie token as a key to a serverside data store. Not only are you limited to 4k of session-local storage, but you're sending the entire payload across the wire for every single request. This is absolutely stupid and needs to change. I'm sure Rob is boxed in by limited time, and this is not intended for production use yet, but holy god, it's by far the worst thing about the framework.