Make Apache run our handler hook earlier.

The mod_auth_mellon hook is designed to handle requests to
MellonEndpointPath rather than looking at r->handler.

If we are unlucky, a different handler hook may look at r->handler,
and decide that the request is meant for it instead of mod_auth_mellon.

This patch makes the mod_auth_mellon hook run before most other hooks.

A workaround is to add something like this to the Apache configuration:

<Location /mellon>
  SetHandler mod_auth_mellon
</Location
Fix session offset bug with creating new session.

When fixing the session offset calculation in 22990058be, I forgot
to update the logic for creating the new session. The result is that
the code for creating new sessions use a different logic for
calculating the session offset than the code for looking up sessions.

This in turn means that we can only have a single session.
NEWS-file for 0.9.1.
Version 0.9.1.