Sessions rest api fix

This is an alternative to #6360, that I committed some time ago but apparently didn't make a PR for (sorry @minrk).

My fix gets rid of the row_factory, as it felt like too much complexity to push into the database API. Instead, it calls `row_to_model()` manually to build the model, and that can raise a KeyError if the session has a missing kernel.