More ssl_session_dup fixes

Fix error handling in ssl_session_dup, as well as incorrect setting up of
the session ticket. Follow on from CVE-2015-1791.

Thanks to LibreSSL project for reporting these issues.

Reviewed-by: Tim Hudson <tjh@openssl.org>