demo / as iframe container
add node-store-based session support

* support cross instance(RAC,DataGuard,Distributed)
* add node session store by app+bsid
* node request handler add var session
* pass session to oracle using request header
* set session to node using response header
* ReqBase set x$app
* add session store demo pack session_b, update index
session store timeout will clean session data

but timeout setting is fixed by now.
move up parseCookie, so rb can use it
rb.done is true stand for all is ok

if no rb.done, standard ReqBase name-value pair is used as the default,
but any existing name-value pair is untouched。
The old behavior is whole new standard ReqBase replace the in-complete one,
and use rb.x$prog to stand for in-completeness.
session store gets will not auto create for none
support session store destroy
comment rb.c$, rb.h$ 's usage
if have session store, give idle milliseconds

send IDLE with other session data alongside
servlet send s$BSID val/null create/destroy store
only when session store exists, then set store
session_b demo mimic PHP session, give url range
pv.bsid pv.msid support large SID data
session_b demo show LAT/IDLE session data

node only send IDLE, LAT must be calculated from IDEL and sysdate
r add s/session get/set API for session store
bugfix k_type_tool.gen_token for st init/extend
session_b demo set s$BSID=null to destroy store
auth_b/auth_s/profile_s/k_filter use new session

* auth_b set PHP cookie and session store when needed
* replace k_sess(s) with r.s based session data get API
  as auth_s.user_name(.login_time),  r.getn(...), r.lat
* auth_s.touch is not need any more since node will update s$IDLE
* remove all .clear since is for GAC cleaning only
k_sess renamed to k_auth, use node session store
no use GAC session any more in http_server

so no touch LAT, just set_identifier for VPD only.