Session control

Session control updates for servers.  This may ultimately be reverted to
simply checking that all client requests present a valid userID (defined
via a cookie after login or some other means).
Revert "Session control"

This reverts commit 41f8f9c9ecc385397859f7444ad6349385eba267.