USER-WP-0039: accept Authelia session ids with RFC 6265 cookie characters

Real Authelia session ids contain '%', '^' and '!'. The narrower check
dropped them, so the Authelia uid always read 'not signed in / unknown'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

tests/test_identity_state.py

@@ -83,6 +83,14 @@ class IdentityStateParseTests(unittest.TestCase):
         self.assertIsNone(authelia_session_token("authelia_session=" + ("a" * 4097)))
         self.assertIsNone(authelia_session_token(""))
 
+    def test_cookie_token_accepts_authelia_session_id_characters(self):
+        # Synthetic value with the punctuation Authelia session ids contain.
+        value = "Ab3%Xy^Qr!st7Z8&*()[]{}<>?@`|:#$'"
+        self.assertEqual(value, authelia_session_token(f"authelia_session={value}; other=no"))
+        for bad in ('a b', 'a"b', "a\\b", "a\tb", "a\x7fb", "aéb"):
+            with self.subTest(bad=bad):
+                self.assertIsNone(authelia_session_token(f"authelia_session={bad}"))
+
     def test_lookup_sends_only_the_session_token_and_fails_closed(self):
         seen = []