adding a `laravel_session[]=` cookie crashes laravel

On laravel.com you can get 500 by adding a `laravel_session[]` cookie, or by changing the `laravel_session` value to something like `../../routes.php`.

The session id should be validated before being used, especially for the file session driver.
This PR makes sure the session id is a valid sha1 hash.