Upstream changes: 0.41 2018-12-05 - Don't let an evil session ID supplier have an easy XSS vector (Michael McClimon++)