Sessions: use hex token instead of base64

Base64 includes '+' which needs to be URL-encoded, which complicates
things for the receiver just enough to make the hex representation
more useful and safer.
Merge sessions--use-hex-token (#8) into master

Sessions: use hex token instead of base64

Base64 includes '+' which needs to be URL-encoded, which complicates
things for the receiver just enough to make the hex representation
more useful and safer.