This nixes the cache in favor of Flask sessions.

The minor complexity is that Flask sessions are HttpOnly, so Angular
can't see them. So we have to store things that Angular needs to know in
"regular cookies" and not the Flask session.

r?