Cart Rewrite

Everything seems to work as expected in my testing, so I think this could be merged into devel.
Note this TODO item. I think we should make methods that take a sessionId arg for all the cart update stuff and remove all client-side Cart.update calls because there is no way to know the sessionId within a deny function, right? Otherwise I can go to the site and update your cart or anyone's from the browser console.

More generally, though, I think sessionId would usually be something known by both client and server, perhaps linked with the `connection` being used. Could be tracked in the same way Meteor knows which user is logged in for any particular client connection. If this were done, then client-side updates could be allowed. I didn't look closely at how you are generating and tracking sessionId yet.