Sessions: use hex token instead of base64

Base64 includes '+' which needs to be URL-encoded, which complicates
things for the receiver just enough to make the hex representation
more useful and safer.