Correct docblock of session method _unserialize()

`_unserialize()` only accepts a string as input.