Don't assume that session was marshaled

Janus incorrectly set symbol as keys and the user model class as is
in the current session object. It broke on a fresh Rails 4.1.0
application, because the session hash was no long serialized.

This commit fixes that by assuming that everything in the session is
a string (hash keys and user model class name).