SSL auth: authenticate directly into session.

Do not use dedicated tokens. Instead pass the encrypted session
identifier and write the authentication results directly into the
current session.
Move SSL verification into a dedicated backend.