Session authentication configuration options.
The session payload is application data, so the framework picks no
conventional key: toPrincipal is the one place that knows where an
identity lives inside the payload, and it is required.
readonly
toPrincipal: (view: SessionView) => IPrincipal | null
Maps an opened session to the principal it carries. Return null when
the session holds no identity — the strategy chain then continues.