Use client-sessions to securely store session data in cookies.

This fixes #379.

It seems client-sessions wants the cookie name to be the same as the name of the property attached to `request` which contains the session data, so I had to change the cookie name from `csol_state` to `session`. Hopefully this isn't a big deal.