Updates to session delete handling to standardize DELETE request and response

After review, modified the DELETE handling for multiple sessions to avoid the use of a body in the request, as this isn't explicitly supported
in HTTP and may not be consistently supported by clients.

DELETE /$DB/_user/$name/_session now deletes all sessions for the specific username.  To delete multiple named sessions for
a given user, multiple requests to DELETE /$DB/_user/$name/_session/$sessionid should be used.

DELETE /$DB/_user/$name/_session/$sessionid now correctly returns a 404 for a name/sessionid mismatch.

Commit also includes a few other cleanup fixes based on code review - consistent use of h.PathVar, and making DeleteUserSessions a
DatabaseContext method.