Use database-only session management

- Just use one cookie that does long-term authentication
- Add ModelImporter helper mixin for nice model import semantics
- Add access-controlled token model with its own collection
  in order to support simultaneous logins
fixes #7. Add virtual initialize method to Resource base class.
Merge pull request #11 from girder/7-db-sessions-only

fixes #7 Use database-only session management