Constrain session value length (bug 898214)