Improved session management (delete, get) via Admin API

Added support for session management/cleanup via the Admin API:

GET /_session/{sessionid}
- retrieves session information for the specified session

DELETE /$DB/_session/$sessionid
- deletes the specified session, with no additional validation

DELETE /_user/$name/_session/$sessionid
- deletes the specified session.  Validates that the session is associated with username=$name

DELETE /_user/$name/_session
- request body is a JSON object with a 'keys' property in the format "keys":["sessionid1","sessionid2",...]
- deletes all sessions in the keys array that are associated with username=$name
- if "*" is passed as a value in the keys array, all sessions associated with the user are deleted

Password change logic was also updated to delete existing user sessions when that user's password is changed.
This should probably be a method on DatabaseContext because it doesn't depend on the current user or on auth checks. (The class names are confusing. "Database" should probably be something like "DatabaseUserRequest" and "DatabaseContext" should probably be "Database".)