Using cookie session instead of redis session.

* Pro: Redis server can now have an eviction policy
    * Pro: Smaller deployments can have activity and main redis together
    * Pro: Cuts down one redis request per API request
    * Pro: Not forced to have an absolute TTL on sessions

    Con \#1: We have to decrypt the user id from the cookie every request.
    Probably better than doing the Redis lookup on every request, though.

    Con \#2: Without an absolute TTL, cookie could be hi-jacked indefinitely
    (until private key changed). Only difference here between Redis impl is
    that the redis cookie will expire eventually. Could attach a timestamp to
    cookie and inspect refresh every so often (e.g., setting a new cookie
    every 30min would require users to make a request at least every 30
    seconds lest they lose their session). This is a classical UX-security
    balance that needs to be made, and can be discussed more later.