Our API specs omit 'session' from both API parameter lists and options classes; we should be putting it in explicitly rather than making people remember which things are included/excluded in the sessions spec.