make sure /sessions doesn't return false hard-coded information
Fixes #400
Merge pull request #401 from jlipps/master

better /sessions