Use a defined session key

Previous to this commit, RubyCAS server did not use a session key to
check the validity of the 'tgt' cookie. This made it it impossible to
invalidate all cookies containing a Ticket Granting Ticket.

This commit adds a **session_secret** key to the config.yml file.
Further, the config.ru now uses Rack::Session::Cookie to manage the
cookies, using the session_secret setting in the config file.
Add migration for previously added authenticator column in casserver_tgt

Previous to this commit, an up-to-date RubyCAS-Server would crash upon
encountering a session that was created before the "authenticator"
column had been added to the casserver_tgt table. This commit is not a
full fix for this problem, but it does prevent the problem from
occurring if the session is retrieved from the server rather than the
cookie.
Session vs. Direct Cookie Acess Bugfix

We initially thought that adding a Rack session helper in front of the
application would allow us to invalidate session by adding in a session
secret. This turned out not to work.

What actually happened was the old session did not match what Rack's
session management expected and the cookie was destroyed. Then CAS
would set and retreive its cookie directly, which would again clobber
the cookie. Then the cycle repeated and all the user got was some lousy
crumbs which wouldn't track their ticket granting ticket at all.

FIX: Conditionally add the session helper. Add three helper methods
for accessing the cookies or session (which depend on if the session
middle ware was loaded or not). Choice of cookie/session & methods
used depends on the the presence of the session secret.
Fixing faulty migration.
Disable caching of the logout page when it is not a redirect
Be more strict about cache control on the login page
Move caching-related headers into a function
Item #98 - Add support for postgresql