use express mounting, kill connect-cookie-session

I was looking through wsapi, and the cascade of functions made go all like `huh?`. We can mount middleware at routes, removing the need for url checking of `/wsapi` in each middleware, and simple mount it at the correct prefix.

This makes it make more sense (imo).

For good measure, ripped out connect-cookie-session, and just used client-sessions.