session: parse_bearers() should check for invalid types