access: mailcookie port using SQLAlchemy

There is a port of mailcookie to SQLAlchemy. We should maybe open a discussion if we are going to improve it or deprecated in favor of any standard solution based on OAuth, [Flask-Security](https://pythonhosted.org/Flask-Security/api.html#flask_security.utils.get_hmac), or other.
Does this means the gc will be called upon every commit. Isn't this a bit too much? In principle this could be called monthly...