remove session.sid
i'm not sure it's necessary. i don't think connect uses an "id" for its cookie session either.  only use is for CSRF, but i feel like people are going to be like "i want the uid to be 24 characters long instead of 15" or something. 

sid is only necessary for db stores IMO
