Fixed an injection vulnerability in session management.

If any session key or value contains a null byte, then the part after
the null is parsed as a separate key/value pair. This fixes it for now
by disallowing null bytes; long term, it may be safer (and almost
certainly smaller) to precede the fields with a length.
Cleaned up a minor style point
Merge pull request #127 from UpstandingHackers/pull-req-session-injection

Fixed an injection vulnerability in session management.