docs: def open_session(self, app, request):
          """
          We load the data from the key itself instead of fetching from
          some external data store. Opposite of _get_session_key(),
          raises BadSignature if signature fails.
  
            $ echo '_json_formatted_' | openssl aes-256-cbc -a -k _passphrase_ -p
            salt=...
            key=...
            iv=...
            _full_encrypted_
          """
          session_key = request.cookies.get(app.session_cookie_name)
          if not session_key:
              found = False
              for path in self.allowed_no_session:
                  if request.path.startswith(str(path)):
                      found = True
                      break
              if not found:
                  app.logger.debug("%s not found in %s", request.path,
                      [str(url) for url in self.allowed_no_session])
                  raise PermissionDenied("No DjaoDjin session key")
  
          session_data = {}
          try:
              session_data = json.loads(crypt.decrypt(
                  session_key, passphrase=self.secret_key))
          except (IndexError, TypeError, ValueError) as _:
              # Incorrect padding in b64decode, incorrect block size in AES,
              # incorrect PKCS#5 padding or malformed json will end-up here.
              pass
          return self.session_class(initial=session_data, session_key=session_key)