Don't read uninitialised data for short session IDs.