pub fn validate_session_id(session_id: &str) -> Result<()>
Reject session IDs that could be used for path traversal or other abuse.
Allowed characters: ASCII letters, digits, hyphens, and underscores.