in reply to Webserver level authentication?

Apache::Session normally generates its own keys, but you can make it take one you generate by writing your own Apache::Sessiom::Generate class. See also Apache::SessionX and Apache::SessionManager.