Removing the 'strong' session protection stuff from Flask-Login.

This breaks other session compatibility stuff that we need for CSRF validation,
since it forces MD5 sums.