function SessionStrategy(options, deserializeUser) {
  if (typeof options == 'function') {
    deserializeUser = options;
    options = undefined;
  }
  options = options || {};
  
  Strategy.call(this);
  
  /** The name of the strategy, set to `'session'`.
   *
   * @type {string}
   * @readonly
   */
  this.name = 'session';
  this._key = options.key || 'passport';
  this._deserializeUser = deserializeUser;
}
Create a new `SessionStrategy` object.

An instance of this strategy is automatically used when creating an
`{@link Authenticator}`.  As such, it is typically unnecessary to create an
instance using this constructor.

@classdesc This `Strategy` authenticates HTTP requests based on the contents
of session data.

The login session must have been previously initiated, typically upon the
user interactively logging in using a HTML form.  During session initiation,
the logged-in user's information is persisted to the session so that it can
be restored on subsequent requests.

Note that this strategy merely restores the authentication state from the
session, it does not authenticate the session itself.  Authenticating the
underlying session is assumed to have been done by the middleware
implementing session support.  This is typically accomplished by setting a
signed cookie, and verifying the signature of that cookie on incoming
requests.

In {@link https://expressjs.com/ Express}-based apps, session support is
commonly provided by {@link https://github.com/expressjs/session `express-session`}
or {@link https://github.com/expressjs/cookie-session `cookie-session`}.

@public
@class
@augments base.Strategy
@param {Object} [options]
@param {string} [options.key='passport'] - Determines what property ("key") on
         the session data where login session data is located.  The login
         session is stored and read from `req.session[key]`.
@param {function} deserializeUser - Function which deserializes user.