Ensure deserialization of session data always returns non-None object.

When deserializing invalid session data, such as an expired session,
the `_get_data()` method sometimes returns None. This fix ensures that
the `data` property always returns an empty dict instead of None in this
and all cases, to avoid breaking subsequent get lookups of the session
data.
Merge pull request #26 from jmurty/feature/fix-session-data-to-never-be-none

Ensure deserialization of session data always returns non-None object.