Use client-sessions to securely store session data in cookies.

It seems client-sessions wants the cookie name to be the same as the name
of the property attached to `request` which contains the session data, so
I had to change the cookie name from `csol_state` to `session`. Hopefully
this isn't a big deal.
Merge pull request #574 from toolness/issue-379-client-sessions

Use client-sessions to securely store session data in cookies.