Key namespace inside the cache. Default 'session:'.

Sessions share the cache with application data, so they share its blast radius: a clear() from elsewhere logs everybody out. The prefix keeps the keys identifiable; a dedicated cache instance is the production answer.