Make the server only retain users that are connected / don't fail on an verified session cookie when connecting long polling

This is part of [this card](https://trello.com/c/suQi4pcr)

Now that we have a client-side stored session in a secure encrypted cookie, the server does not need to know who is signed in but not connected.

Therefore we can simplify the users list to just be those who are connected to the server.

The positive side effect of this simplification is that it fixes a bug where restarting the server would not allow users who had a valid client-side session cookie to reconnect.