The double hash is stored on session creation. But that still implies what I said in my last comment.