Using cookie session instead of redis session.

* Pro: Redis server can now have an eviction policy
* Pro: Smaller deployments can have activity and main redis together
* Pro: Cuts down one redis request per API request
* Pro: Not forced to have an absolute TTL on sessions

* Con: We have to decrypt the user id from the cookie every request. Probably better than doing the Redis lookup on every request, though.

* Con: Without an absolute TTL, cookie could be hi-jacked indefinitely (until private key changed). Only difference here between Redis impl is that the redis cookie will expire eventually. Could attach a timestamp to cookie and inspect refresh every so often (e.g., setting a new cookie every 30min would require users to make a request at least every 30 seconds lest they lose their session).

The second Con is a classical UX-security balance, and can be discussed more later.