Session hardening

Some further hardening of ```cockpit-session```

Don't allow unauthenticated sessions. Currently the only form of authentication is password based,  but in the future we'll pass gssapi kerberos input to cockpit-session for authentication.

Also cockpit-session runs in a different security context (at least SELinux) than cockpit-ws. So don't trust cockpit-ws to tell us which agent to run.