Handle non-existent session

Previously, if there was a request to load a non-existent session the
de-serializer would throw an NPE (unable to access the appropriate
byte[]).  This change handles that (common) case much more nicely by
returning a null session in that case.

[#66763922]
Merge 66763922-npe to master

[Completes #66763922]