Having a blacklist is probably still preferable to storing every session though in that there should be less data stored, if only marginally