Loading a session by ID should not create a new session with the given ID

The interface specifies that findSession should return null if an active session
cannot be found. By creating and returning a new session instead of null, the 
code prevented any protection against a session fixation attack.

Also, clean up a little bit of logging.