session: ensure that sessions files have permissions 600

A malicious user could use other users session files since
their permissions were 644 by default
bugfix #336