Merge pull request #458 from DrDoof/fix/httpd-session-init

httpd: do not accept a session cookie before the first login

httpd/httpd.c

@@ -340,7 +340,7 @@ __xdata uint8_t *scan_header(__xdata uint8_t * __xdata p)
 
 	read_reg_timer(&now);
 
-	if (session) {
+	if (session && session_id[0]) {
 		if (now - last_session_use > SESSION_TIMEOUT) {
 			dbg_string("Session expired\n");
 		} else {