Look up id, or allocate a new session when id is empty. Purges idle sessions first; touches last_used on success.
| id |
client X-rpc-session value, or empty to create |
|
session, or null when id is non-empty and unknown/expired |