Add redis sessions and reauth to admin app

This PR also contains the redis session commit, plus changes things to set a
prefix. I'm happy to rebase the original PR, but it might be easier to commit
this as a single PR.
What's the difference between these two? We currently have a bug where after 2 hours the session is expired but the app doesn't know without talking to signon. Could we do expire on our end here?