Tiny fixes
Do not use legacy sessions when not advertised by the server,
This makes JsJac a bit more consistently compliant with RFC 6120. (Fixes #411)