added session handling

Added simple session handling.  Stores all session data in cookies (Bad
real world practice, but works as an example) and looks for a 'user'
value to tell if the client is logged in.  If an Authorization header is
successfully processed, the username is stored as 'user' in the session.