httpd: do not accept a session cookie before the first login

session_id is cleared at boot and only a successful login fills it in,
while the uptime counter and last_session_use both start at 0. For the
first SESSION_TIMEOUT seconds after a start, a request carrying an empty
"Cookie: session=" therefore passes is_word_x(session, session_id) and
is treated as logged in, which is enough for /cmd, /config and /upload.

Only look at the cookie once a session has been handed out.

httpd/httpd.c

@@ -340,7 +340,7 @@ __xdata uint8_t *scan_header(__xdata uint8_t * __xdata p)
 
 	read_reg_timer(&now);
 
-	if (session) {
+	if (session && session_id[0]) {
 		if (now - last_session_use > SESSION_TIMEOUT) {
 			dbg_string("Session expired\n");
 		} else {