using client-sessions for maximum securiteh
Rename ticketDuration to sessionDuration
Remove superfluous issued / ttl inside cookie

The client-sessions middleware takes care of invalidating cookies once they
expire, so we don't need to do our own checks. Without those checks,
getAuthedEmail becomes trivial:

    function getAuthedEmail(req) {
      var certify = req.session.certify;
      var authedEmail = '';
      if (certify && certify.email) {
        authedEmail = certify.email;
      }
      return authedEmail;
    }

At which point, we might as well just directly store the proven email address in
the session (as `req.session.proven`) and reference that.
Merge pull request #23 from callahad/client-sessions

Use client-sessions instead of Connect sessions. Part of #22