models.RbacSession: Remove caching logic
models.RbacSession: Only reference session by id, not by session_key
models.RbacSession: Move constructor magic to management command

Deleting expired sessions in the RbacSession constructor is not a good
idea - especially under high workloads. Just like with
django.contrib.sessions this task can be performed periodically by a
CRON job.
models.RbacSession: Remove _clear_cache() from save()
middleware.RbacSessionMiddleware: Handle invalid IDs in session data