Added validation of session key format

Added a check to ensure the session key contains only alphanumeric characters, '_', or '-'.  This is to prevent a minor directory traversal issue where cache files could be forced to be created in the data_dir or the parent of file_dir.
Included a simple test to demonstrate the issue/assert it is fixed.