Move fake session to HTTPClient

The fake session object is to prevent a cyclical dependency between
HTTPClient and the session from leaving hanging session objects around.

This is still necessary if you construct a client the old way however if
you are using the session properly then there is no cyclical dependency
and so we shouldn't prevent people using the connection pooling
advantages of the session.

Related-Bug: #1282089
Change-Id: Ifca2c7ddd95a81af01ee43246ecc8e74abf95602
Hash for PKIZ

Only PKI (asn1) based tokens were checked for format and hashed

Closes-Bug: 1355125

SecurityImpact

Change-Id: Iefedde7f168e2ff1870905041fa95301934452e5
Merge "Hash for PKIZ"
Merge "Move fake session to HTTPClient"