add comment on why this.sessionXxxxx is necessary

closes #15
remove setting sid

connect’s cookie session doesn’t set any IDs itself.
IDs are pretty useless since sessions aren’t back by a store - use a db
session otherwise.
these are cookies sent to the client every time - should be as small
and unopinionated as possible.
also, cleans up code!
only save new sessions if populated

closes #17
populated alias
remove this.sessionXxxx tests

these are internal and don’t matter to the end user.
remove uid2 dep