Breaking API change, adding a "session_id" field to Open and Close
calls.

Multiple sessions can be attached to the same decrypted key, each
expiring (or being closed) independently: the key will only be dropped
when the last session terminates.

This makes it easier to detect unexpected errors.