merge from Evolvis: better session_redirect()
merge from Evolvis: for session_set_admin use the lowest-uid one
instead of impersonating a random person who’s got forge admin rights
make this closer to the code in EvolvisForge (should be no change)

everything that would change FF behaviour is commented out atm
SECURITY: use HMAC-SHA256 (for now) to protect the session cookie

NOTE: after installing this patch, it is *vital* to change your
forge_get_config('session_key') because you *MUST* assume that
the old value is insecure and/or has been leaked!