Close potential security hole

This used to read User.query.filter_by(session_token=token), but that
generates "session_token is NULL" when token is None, and we need
"session_token = NULL", or else we will match arbitrary users(!).
This is a bit of WTF from SQLAlchemy here, IMO: it dangerously opts for
idiomatic Python over idiomatic SQL. We fell prey, at least. :-/
Bump version to 7.0.34
Bump version to 7.0.34-dev