Enforce session as array data, and settings api tweak for special chars. Closes #3135.