Sessions rest api fix

This is an alternative to #6360, that I committed some time ago but apparently didn't make a PR for (sorry @minrk).

My fix gets rid of the row_factory, as it felt like too much complexity to push into the database API. Instead, it calls `row_to_model()` manually to build the model, and that can raise a KeyError if the session has a missing kernel.
"Should never occur" isn't quite right because this will happen if the kernel has died (all the way, and restarting failed).