title: Does the Play! framework have any built in mechanism to prevent session hijacking?
body: <p>I've read that the play framework solves the session fixation issue by hashing the session id with the application key, but does it provide any mechanism to prevent session hijacking, or is this left up to the implementor? </p>