protected Session createSession(SessionContext context) throws AuthorizationException {
        enableSessionValidationIfNecessary();
        return doCreateSession(context);
    }
Looks up a session from the underlying data store based on the specified session key.

@param key the session key to use to look up the target session.
@return the session identified by {@code sessionId}.
@throws UnknownSessionException if there is no session identified by {@code sessionId}.
core/src/main/java/org/apache/shiro/session/mgt/AbstractValidatingSessionManager.java