Sessions, CSRF, and User Authentication

- [x]  CSRF
- [x] A better session store than the file system
- [x] ``?next=`` Handling
- [x] Some way to actually interact with a logged in user once they've been logged in *(Deferred until a PR that will actually use it)*
- [x] Internationalization
- [x] Error Logging
- [x] Log out / Unauthenticate
- [x] A solution to the ``nonlocal`` keyword used in the ``SessionMiddleware`` class.
- [x] A solution to adding a keyword argument to the ``LoginForm().__init__()`` method.
- [x] Figure out if we actually want to issue a ``Set-Cookie`` every time the session is saved, and if not when do we want to?
- [x] Ensure we do not allow X-Forwarded-* through from the client side *(Moved to #256)*
- [x] Figure out the expiration time for a session
- [x] Documentation
- [x] Tests!

However right now it should:

- Successfully accept credentials of a user and store their user id in the session
- Rotate the session id when crossing authentication boundaries
- Prevent leaking of session state when going from one logged in user to another
- Automatically upgrade to newer, securer passwords during log in
- Stash the username in a cookie so javascript can easily access it for **display** purposes only.
- Properly set a ``Vary: Cookie`` header anytime the session is being used.

#### Security Note

It is important to remember that this code will be running on pypi.python.org. We have TLS setup on pypi.python.org with far future STS headers, as well as any subdomain of pypi.python.org *HOWEVER* the same cannot be said for the rest of python.org. This means that sibling and parent domains are potential threats.