api/sessions: document bcrypt implementation curiosity

[alxndrsn]

This behaviour was noted by @sadiqkhoja, and seemed at least worth documenting if not fixing.

Closes #1409

What has been done to verify that this works as intended?

Added a test.

Why is this the best possible solution? Were any other approaches considered?

An alternative to this test would be to check for NUL characters in supplied passwords and reject them before passing the values to bcrypt.

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

No effect.

Does this change require updates to the API documentation? If so, please update docs/api.yaml as part of this PR.

No.

Before submitting this PR, please make sure you have:

• run make test and confirmed all checks still pass OR confirm CircleCI build passes
• verified that any code from external sources are properly credited in comments or that everything is internally sourced

[sadiqkhoja]

We discussed this in the meeting and concluded that just documenting the behaviour is sufficient.