Restructure to remove (useless/crazy) HMAC signing of sessions.

- Also update for riak client v2
- Borrow Django's handling of PRNG to get session tokens