Remove redis session

Managing token caching and reauth has been moved back into stagecraft to
avoid a call back to signon for every request there.
Log user out on 401 not 403

Unauthorized and Forbidden have been split out in stagecraft now. We
should not sign the user out if they do not have sufficient permissions.
Merge pull request #41 from alphagov/remove-redis-session

Remove redis session
Alphabetise requirements

because pedantry