Prune cookietokens in db, use nonces in session IDs.