Feature: Security

- fixes a security flaw with incremental session id where a bad guy after obtaining correct instance and compId could upload to other people's accounts by varying session id
- implements better oauth callback state param checking (now sends an encrypted JSON)
- tests for encryption