itsdangerous-alternative
Signed, timestamped cookie sessions + CSRF tokens (HMAC), no server-side store. Pure Python, zero dependencies.