Use correct SessionConfig
SecureRandomSessionIdGenerator allows configuration of the session id length, but doesn't actually use the configured value.
Don't allow session cookie fallback to be used with SSL
Move path encoding logic to the correct place