Auth session extension points and a WebSudo feature

Provides hooks to allow plugins to get access to the session lifecycle events, without needing to customise the session type. 

The WebSudo feature is the use-case that drove the session hooks. WebSudo allows service methods/Request DTOs to be designated as requiring a re-authentication of the current user to continue. The 402 status code was chosen as more of convenience to the web developer, making it easier to determine if the user is not authenticated, needs to re-authenticate or is forbidden. Any feedback appreciated :)