stateless authentication

Stateless authentication added, can be turned on with useSession = true configuration key (see usage sample).

Intermediate states are written into session. I suggest to make this default authentication option after the review, because cache is wrong for two reasons: it may invalidate the stored value suddenly, and it is not compatible with distributed (cloud) applications.