A playback URL carried up to two credentials: the sid, a bare TID minted on the first playlist request that viewer counts and view logs key by, which anyone could forge or spray; and, for the streamer's pre-live preview, a separate HMAC token. They are now one thing, pkg/psession: the sid is `1.<tid>.<scope>.<expiry>.<signature>`, signed together with the stream it was minted for. A session opens only that stream; a forged one opens nothing; renewals keep the TID so a playback keeps counting as one session, and view logs (the node's own and the CDN log ingest) key by the TID alone. Scopes: public (what a playlist hands an anonymous viewer, 24h, renewed past half-life on every playlist rendered) and owner (the streamer's own, 1h, minted through the authenticated getPlaybackSession query, which replaces getLiveToken). Only an owner session opens an unpublished (pre-live) stream; the `token` parameter is gone from getLivePlaylist and getLiveSegment. Handlers verify a session against the stream, refuse a malformed or forged one, renew an expired one under its own id, and hand a first request a fresh one. A media playlist that arrives without a session is redirected to the same URL carrying one, so a player that polls a sid-less URL (the audio-only path did) shares one session across its polls instead of starting a new one each time. Segment URLs out of a playlist must carry a valid session; CDN-served segment URLs carry none and rely on the CDN's own signing, as before. VOD playlists get the same treatment, bound to the video's owner. The signing key lives in statedb so every node in a station honours the others' sessions, and is read once per process.