Use in-database sessions for login

Based on the existing token mechanism.  Timeout is 4 weeks.

Closes assembla-172