fix: session delete action

[lfleischmann]

Description

1. The delete session action is available/present in a response even if there is only one active session and it is equal to the current session.
2. The input is not properly validated so deleting other user's sessions is possible.

Implementation

1. Suspend the action during initialization if there is no other session than the current one.
2. Validate the input (and hence its allowed values) during execution.

How to test

1. Log in to establish a session. The action should not be present in the response. Then establish one or more sessions, the action should be present again.
2. Login with users A and B, establish one more session for user A (or else the action would not be present, see 1.). As user A, try to delete the session from user B. The input should now be validated and an error should be returned (because User B's session is not in the allowed values).