They're both constant per-instance values, there is no need to store them in the session. This also makes the code a bit more readable by moving the `session_challenge_key` method up to the `DiscourseWebauthn` module.
This method slipped in by accident in 10c6b2a and is not used.
10c6b2a