The data and session sections are not filtered, and can leak sensitive information

[trammel]

In the default _data and _session templates serialize the @DaTa and @request.session information, but they aren't filtered. So sensitive information like the session_id and any other information stored there are exposed via whatever notification mechanism is used.

#363 submitted as well.