def open_session(self, app, request):
        """
        We load the data from the key itself instead of fetching from
        some external data store. Opposite of _get_session_key(),
        raises BadSignature if signature fails.

          $ echo '_json_formatted_' | openssl aes-256-cbc -a -k _passphrase_ -p
          salt=...
          key=...
          iv=...
          _full_encrypted_
        """
        session_key = request.cookies.get(app.session_cookie_name)
        if not session_key:
            found = False
            for path in self.allowed_no_session:
                if request.path.startswith(str(path)):
                    found = True
                    break
            if not found:
                app.logger.debug("%s not found in %s", request.path,
                    [str(url) for url in self.allowed_no_session])
                raise PermissionDenied("No DjaoDjin session key")

        session_data = {}
        try:
            session_data = json.loads(crypt.decrypt(
                session_key, passphrase=self.secret_key))
        except (IndexError, TypeError, ValueError) as _:
            # Incorrect padding in b64decode, incorrect block size in AES,
            # incorrect PKCS#5 padding or malformed json will end-up here.
            pass
        return self.session_class(initial=session_data, session_key=session_key)
We load the data from the key itself instead of fetching from
        some external data store. Opposite of _get_session_key(),
        raises BadSignature if signature fails.

          $ echo '_json_formatted_' | openssl aes-256-cbc -a -k _passphrase_ -p
          salt=...
          key=...
          iv=...
          _full_encrypted_