refactor(Session): use User and Account models in lieu of Session

This refactor changes a number of things:
- introduces User and Account models
- imports old Session based sessions into User
- handles direct link to settings page from RPs for a specified account (fixes #1686)
- redirects unverified accounts that visit /settings (fixes #1716)
- introduces a way to pass ephemeral data between views
- removes unused avatar-change-via-URL resources/tests (fixes #1544, fixes #1618)
refactor(account): User always returns an account; no more null