How does Drupal handle sessions?