espra/auth: rename session to auth and rework the signed payload.