Improved session management (delete, get) via Admin API

Added support for session management/cleanup via the Admin API:

GET /_session/{sessionid}
- retrieves session information for the specified session

DELETE /$DB/_session/$sessionid
- deletes the specified session, with no additional validation

DELETE /_user/$name/_session/$sessionid
- deletes the specified session.  Validates that the session is associated with username=$name

DELETE /_user/$name/_session
- request body is a JSON object with a 'keys' property in the format "keys":["sessionid1","sessionid2",...]
- deletes all sessions in the keys array that are associated with username=$name
- if "*" is passed as a value in the keys array, all sessions associated with the user are deleted

Password change logic was also updated to delete sessions for a user when that user's password is changed.
Updates to session delete handling to standardize DELETE request and response

After review, modified the DELETE handling for multiple sessions to avoid the use of a body in the request, as this isn't explicitly supported
in HTTP and may not be consistently supported by clients.

DELETE /$DB/_user/$name/_session now deletes all sessions for the specific username.  To delete multiple named sessions for
a given user, multiple requests to DELETE /$DB/_user/$name/_session/$sessionid should be used.

DELETE /$DB/_user/$name/_session/$sessionid now correctly returns a 404 for a name/sessionid mismatch.

Commit also includes a few other cleanup fixes based on code review - consistent use of h.PathVar, and making DeleteUserSessions a
DatabaseContext method.
Merge pull request #462 from couchbase/feature/issue_76

Improved session management (delete, get) via Admin API

Fixes #76