[1.6.x] Fixed a sentence in the session security docs; thanks claudep.

Backport of 4d27d311f6 from master