Fix various issues:

- Use DI for creation to allow user-configuration of backends
- Correct some method signatures
- Fix bootstrapping issues with cookie key configuration
- Fix issues with database being operated on when not ready (such as when using testsession)
- Fix issue with cookie expiry of 0 being misinterpreted
Crypto is expensive to construct - we shouldn't be creating it if we don't need it.