session: fix non-NULL terminated string