vcl: validate vep handle when copying sessions on fork