Store user sessions separately from users.

Two great consequences:

1) We can log everybody out (by sql alone for now:
   "DELETE FROM session;"). This commit will effectively log everyone
   out because the evolution starts the table out empty; this will
   resolve our Heartbleed woes.

2) When a user logs out, the cookie representing the session becomes
   worthless.