Session class changes -- Doesn't work, doesn't include other changed files yet.
Changes to get cookie-free session.
Serialize data properly, use session_id from object.
Let closures be validators without throwing errors.
Let Session->changed be accessed externally.
Add some todo's for storing anonymous user token data.
Use the PHP default session cookie params when sending ours.
When sending a cookie, the time is when it should expire, not its lifetime.
When we destroy a session, get rid of its cookie too.
Stop using a constant for skipping the subnet check in Sessions.
Update some PHPDocs.
Add an implementation of session_cache_limiter to send caching headers.
Refactor the new sessions into two different classes.

One is SessionStorage, which extends ArrayObject and holds the actual data. This should be further abstracted in the future to include all the database-accessing code so you can have multiple backends for the actual storage (similar to the Cache class).

The other is the Session class, which is totally static and extends Singleton. This handles all the things it always has: reading, writing, destroying, etc.
Destroy the session when a user logs out.

We were unsure why we seemed to avoid this in the past. With the new limited sessions, you would continue to send the cookie with each request, and therefore start a new session every page load, if the session were not destroyed.
Dump the garbage collection trigger for sessions.

We're going to be moving it out-of-band shortly.
When reading sessions, don't delete anything.

Instead, we'll just not let you use the session if it's not valid and expire your session cookie. If you then write to the session, a new one will get generated. Otherwise, you're back out in the cold, as if you hadn't pretended to have one in the first place.
Merge branch 'master' of github.com:habari/system