"Unprivate" constructor of http.session.Session

The constructor should be public, since the class is a part of the SessionStore interface.