Always leave the _authentication_token set.

This was added a long, long time ago as a part of the StoreSessionModule
in silverorange/store@64a2853 where CSRF prevention was added for all
sessions that had accounts. It was then later moved to the
SiteSessionModule in commit silverorange/site@1c9b22e. It was at this
point that CSRF was added for all active sessions on the website. We
want the _authentication_token set at all times now so don't unset it
when a logout occurs.
Move the last auth token code to session module.
Generate the token if the session doesn't have it.
Remove whitespace.
Merge pull request #41 from charleswaddell/six-year-old-bug

Always leave the _authentication_token set.