Ensure deserialization of session data always returns non-None object.

When deserializing invalid session data, such as an expired session,
the `_get_data()` method sometimes returns None. This fix ensures that
the `data` property always returns an empty dict instead of None in this
and all cases, to avoid breaking subsequent get lookups of the session
data.