Variable PROTECTED_SESSION_CONFIG_KEYS`Const`

PROTECTED_SESSION_CONFIG_KEYS: readonly string[] = ...

The Config keys only trusted server code may add, change or remove. New server-authoritative session keys belong here (and nowhere else).