Wrong usage of strtolower and substr

I was about to submit the exact same patch.

Also note that this will fix the weird behavior that new sessions are created on every request for some sites. In fact, this is only the case if the $_SESSION superglobal contains data at the end of a request. The faulty code generates PHP warnings, and those will be stored as messages in the session (unless suppressed by the site admin).

The take home notice here is: If you see sessions started on api requests, then your code is likely buggy. Check your logs.

This patch no longer applies to 7.x-1.3

This patch is against 7.x-1.x (i.e. the dev branch) and it certainly applies there. Regrettably that version is not selectable from the version dropdown in this issue tracker.

Apologies. I didn't see a dev branch posted. That make sense then.

Thanks for the patch! This has been committed :)