Silently return nil for session when client supplies unknown session id

When using ActiveRecord for session storage, it raises `ActiveRecord::RecordNotFound` for nonexistent session ids. Gotta handle that.