chat idor bug fix (#692)

deliberately dropping the string session_id key to prevent idor hack in chat

Author: tanfarming

lib/ret_web/channels/hub_channel.ex

@@ -301,7 +301,10 @@ defmodule RetWeb.HubChannel do
       broadcast!(
         socket,
         event,
-        payload |> Map.put(:session_id, socket.assigns.session_id) |> payload_with_from(socket)
+        payload
+        |> Map.delete("session_id")
+        |> Map.put(:session_id, socket.assigns.session_id)
+        |> payload_with_from(socket)
       )
     end