Default to the active session when none specified.

We have an inconsistency in the sandbox... `insertAtCursor` can accept `null` as a path (choosing the active session in that case). This makes *all* sandbox APIs take a null to mean the active session.