Use _id instead of e-mail address as SSO session username.

This is necessary to support logout after a primary e-mail change.
Add comment about request signature validation being a possible DoS.