Don't look up session id undefined

Otherwise a client can squat session id "undefined" (the string, not the value)
and prevent WebSocket-based transports, with session id undefined (the value),
from connecting.