Initial web admin API implementation
Support alphanumeric session IDs.

Session IDs may now contain letters (a-z, A-Z) and the punctuation
characters : and - in addition to numbers.
This is for future proofing. We may want to use GUIDs or vanity IDs
later on.