Correct docblock for session _unserialize method

`_unserialize()` only ever accepts a string.