Isolate session namespaces between users

Also provide backwards compatibility for API clients that do not set
the session_id attribute, in which case the server reverts to the old
behavior (no support for multiple concurrent sessions).