Update and tweak docs for new name.
Rename `this.session` to `this.connection`.
History note for session hooks.
Because sessions are only logged in with hashed tokens, we don't need
to close sessions when unhashed tokens are removed from the database.

Move constructing an old-style unhashed token for testing into the
test code.

Only hash the token once in the resume login handler.
Carefully avoid race conditions when upgrading to a hashed token.
Close loophole where a session could successfully log in with a token
and then the token could be deleted without the session being closed.
Merge branch 'pr-1611' into hash-login-tokens