Improved session management (delete, get) via Admin API

Added support for session management/cleanup via the Admin API:

GET /_session/{sessionid}
- retrieves session information for the specified session

DELETE /$DB/_session/$sessionid
- deletes the specified session, with no additional validation

DELETE /_user/$name/_session/$sessionid
- deletes the specified session.  Validates that the session is associated with username=$name

DELETE /_user/$name/_session
- request body is a JSON object with a 'keys' property in the format "keys":["sessionid1","sessionid2",...]
- deletes all sessions in the keys array that are associated with username=$name
- if "*" is passed as a value in the keys array, all sessions associated with the user are deleted

Password change logic was also updated to delete existing user sessions when that user's password is changed.