Use a single DB session per request, passed implicitly in SiteRequest

For some reason the implicit accessor doesn't seem to work inside views, but
probably views should be avoiding DB access anyway so I might be okay with
that.

The login handling is an exception here, and so a bit messy, but it was
already.