Quorum consistency on sessions to avoid problems.

Eventual consistency isn't great when you only check one server and keep
getting bounced around.
Only logged in users should access /app for now
Tidy up and fix of NPE on authz checking.
Merge pull request #53 from MastodonC/feature/security-extraction

Feature/security extraction