Only replace votes in the current session

Previously, the PUT /vote was overwriting the first vote for that user
without checking that the overwritten vote was in the same session.
Now, we only overwrite if the user and session match.