Fixed an injection vulnerability in session management.

If any session key or value contains a null byte, then the part after
the null is parsed as a separate key/value pair. This fixes it for now
by disallowing null bytes; long term, it may be safer (and almost
certainly smaller) to precede the fields with a length.