a dictionary stored on the client as a signed, encrypted cookie. As long as your `SECRET_KEY` is kept secret, the session data cannot be tampered with.