Check session expiration server-side
Force internal session expiry after 24 hours if no expiry is defined
Stop converting timestamps to UTC because the database still thinks they're local
Rename confusing remnant "@pool" to "@table"
Change the schema for the sessions table, + other fixes

The old sessions table required checking for session id collisions
in the database, and it still wasn't completely immune to collisions
in a race condition, potentially leading to an unhandled error
resulting in an error message to the user. Additionally, it required
hashing the sid at least twice per request, without resorting to
ugly hacks.

The new schema lets the database pick a unique primary key (a normal
autoincrementing 64-bit integer). This is combined with a random
128-bit token (like the old sid), which is basically a password for
the given row. The token is still stored in the database salted and
hashed, and both the plaintext token and the primary key are stored
in the cookie (separated by a dash). This leads to speed optimizations
in a variety of places, and cleans up a lot of code.

Now the updated_at column is already set on insert, so that there's
no need to fall back to created_at in case it's null. This also makes
it easier to prune old expired sessions from the database.