Improved session management (delete, get) via Admin API

Added support for session management/cleanup via the Admin API:

GET /_session/{sessionid}
- retrieves session information for the specified session

DELETE /$DB/_session/$sessionid
- deletes the specified session, with no additional validation

DELETE /_user/$name/_session/$sessionid
- deletes the specified session.  Validates that the session is associated with username=$name

DELETE /_user/$name/_session
- request body is a JSON object with a 'keys' property in the format "keys":["sessionid1","sessionid2",...]
- deletes all sessions in the keys array that are associated with username=$name
- if "*" is passed as a value in the keys array, all sessions associated with the user are deleted

Password change logic was also updated to delete existing user sessions when that user's password is changed.
I don't think that's the case (although I should add a unit test to validate) - if there's an error reading the JSON, it should carry on with deleteAll = false and sessionIds as an empty array, and so won't do anything when it falls through to the code below.  I can switch this to an explicit check for a request body to make the code more explicit, though, if you think it's warranted.