fixes #7 Use database-only session management

- Just use one cookie that does long-term authentication
- Add ModelImporter helper mixin for nice model import semantics
- Add access-controlled token model with its own collection
  in order to support simultaneous logins