improve session hashing when detecting modified sessions

There is an issue in hash function https://github.com/expressjs/session/blob/master/index.js#L582 simple JSON.stringify is not safe to use as when session contains an object with multiple properties inside (user for example with id, name, position properties). JSON.stringify can return different string (id, name, position or position, id, name). We need to do safe object keys sorting before serializing or use some kind of safe object hashing (e.g. https://github.com/puleos/object-hash)

[dougwilson]

Yea, currently the implementation does give false positives. This idea here is that it’s better to just save again on accident than to accidentally not save when there was a change (i.e. false positives are ok vs false negatives are really bad). Ideally it would have no false anything, though. Efforts along those lines are welcome!

[skarbovskiy]

no, only for cases when session data use the same structure as object-hash internally (that is very unlikely)