Store authenticated userid on cookie, not redis

* Pro: Redis server can now have an eviction policy
* Pro: Smaller deployments can have activity and main redis together
* Pro: Cuts down one redis request per API request
* Pro: Not forced to have an absolute TTL on sessions

Con #1: UserID is visible on cookie. TODO: needs encryption

Con #2: Without absolute TTL, cookie could be hi-jacked indefinitely
(until private key changed). Only difference here between Redis impl is
that the redis cookie will expire eventually. Could attach a timestamp
to cookie and inspect refresh every so often (e.g., setting a new cookie
every 30min would require users to make a request at least every 30
seconds lest they lose their session).
Encrypting userid in cookie