Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)