They're both constant per-instance values, there is no need to store them in the session. This also makes the code a bit more readable by moving the `session_challenge_key` method up to the `DiscourseWebauthn` module.
app/*