stateless authentication

Stateless authentication added, can be turned on with useSession = true configuration key (see usage sample).

Intermediate states are written into session. I suggest to make this default authentication option after the review, because cache is wrong for two reasons: it may invalidate the stored value suddenly, and it is not compatible with distributed (cloud) applications.
Wouldn't it make sense to read this setting from the application.conf/mine.conf and fall back to the default of 15 min?