Remove Factory usage from the Session package

This PR removes all usage of the global `Factory` class from the `Session` package. 

Specifically, it:
- Moves configuration for Storage Drivers into the constructor
- Requires the injection of a `db` parameter when using the Database Storage Driver.
- Moves `getFormToken` and `checkToken` into `AbstractWebApplication`, including the tests.