Cookie authentication

This is a bit of a monster change...not as bit as Sql Parameters but probably very close.

I have removed all the custom cookie session code. New approach uses ClaimsIdentity and Owin Cookie Auth middleware.

Let me know what you think about this approach. See the Blog Post 5.6 branch for details. Blog post not complete but should have the details at least.
What if, instead of allowing child pages to override the AuthorizedRoles when their page needs different roles we use some reflection to examine the properties on the current class? We could then use the same [Authorize] attributes used by MVC. It would keep things consistent. In fact it is such a good idea I think I might implement it in my own project.