Improve http session object security

Add session permission system which is writable only by trusted.
Move session variables to session.vars, with Session no longer being derived
directly froom ScriptMap.
SconesiteStream now checks "upload" permission when deciding whether
to accept file upload sections.