SessionSerializer: Truly unique URIs

Before, only spent uris where sanitized not to be contained within
remaining uris. Change this so that each uri in the
union(remaining,spent) get saved once at most.
The order of the uris will won't be changed, with remaining uris going
first followed by spent uris.

Also avoid copying the uri std::strings around during dupe checking,
usually resulting in better performance regarding CPU and space.