Accept ToU via session token (for OpenID)

Adds a new way to accept the terms of use via a session token.  This works only if you get a session token via OpenID (because other approaches will throw an error before you get the token).

Also adds an exception class for ToU, so that it can be mapped to 403's.