check session against userdb for auth (fixes #264)

This is to prevent deleted users from remaining logged in by keeping
their session active. There's no simple way to iterate over cherrypy
active sessions, so a check is done if the logged in username is in
the user database. If not, the session is logged out.