Fix EZP-21991: UserHash should be cached tied to user session id, not user cookies

https://jira.ez.no/browse/EZP-21991

This patch makes the UserHash cache key to be only bound to the user session id.

## Important note
Session cookie path/domain/lifetime issue is voluntarily not addressed here and will be fixed in a different PR.