[2.0] Decouple Session package from Application

This is a work in progress to decouple the deprecated Session package from the Application package.  Currently we still need to handle the logic in the `checkToken()` and `getFormToken()` methods to cope with the session no longer being present.