Store session objects in active_record_store

Rather than in the cookie store, which has a 4KB limit meaning we cannot
store objects - only IDs