Move "POST /controller/id" down to subclasses

The controller routing can't have a route with an long and Guid ID, so we
need the subclasses to say which they support.

Also updates the front-end to use "POST /session/id" for updating a session,
and any instances of sessionId to use a Guid instead of a long.