Switched from PHP sessions to custom sessions.

When using PHP sessions, the session cookie was sent with every page,
which causes the responses to bypass server-side caching.  To fix this,
we implement out own session cookies using WordPress Transients as
our storage backend.  Our session cookies are set only when a user signs
in (at the redirect step) and are aggressively removed when expired or
no longer needed.