session: Assert that appkey length is 321

I'm not totally confident that this is the only appkey length in use, but it
matches all keys I've seen so far. Currently, it's more important to avoid
segfaulting the first minute a new user is using the library than to work with
all possible appkeys in existence. Hopefully, anyone with a valid appkey that
isn't 321 bytes long will file an issue.
docs: Some headers for the tutorial