New Session leaks "invalid argument"

The intent of the New Session algorithm (as made clear in step 2) is for a failure to create a session to result in an error of "session not created" being returned. My belief is that all implementations follow this expected behaviour.

However, a close reading of the spec shows that step 4 of the main algorithm "tries" to process the capabilities. There are several paths through this algorithm that cause an "invalid argument" to be returned, which, given the way that Step 4 is written, will bubble back to the end user.

The simplest fix is to indicate that the returned "invalid parameter" is passed back as the "data" section of the "session not created" error, which allows the information to be returned to the user in a meaningful way. The alternative is to allow two kinds of error to be returned by the algorithm, but this will break expected results and widespread implementations.

Opening this to the floor for discussion, but I am happy to write up the decision we take.