Fix timing attack on session hash

http://seclists.org/fulldisclosure/2014/May/54

Signed-off-by: Florian Pritz <bluewind@xinu.at>