Separate auth server and client sessions with different cookie names

So that when testing on the local machine, the sessions don't interfere
with each other.
Indent
Rename Authorization Decision "removed" to "revoked"
Add README.md
Start on unit tests for the datastore
Add a constructor for the datastore
Use full object paths
Infusion-ize the datastore
Convert the datastore to an Infusion component
Rename the resource endpoint to /settings to match the Flow Manager
Add some notes from Antranig