Clarify payload expectations for n == 0 vs n > 0 SessionData messages

[jadamcrain]

From @emgre:

It is not clear whether of not empty payload messages are supported. In section 5.5.6, it says that "empty session messages are explicitly disallowed", while in the section 5.4, is says that an implementation willing to wait for full authentication can send a zero-payload session data.