implement session support with shiro for #8
use custom session DAO #8
add support for flash sessions values #8
expose shiro Subject and associated session #8

Only expose shiro Subject as the API to use.
The underlying session that is made injectable is first associated with
the subject.
use session factory to create session instances #8