implement session usage for web interface login

the web interface will now use session ids exclusively
sessions reads are cached in the server now (to prevent multiple loading of sessions in one request)