Improved session management (delete, get) via Admin API

Added support for session management/cleanup via the Admin API:

GET /_session/{sessionid}
- retrieves session information for the specified session

DELETE /$DB/_session/$sessionid
- deletes the specified session, with no additional validation

DELETE /_user/$name/_session/$sessionid
- deletes the specified session.  Validates that the session is associated with username=$name

DELETE /_user/$name/_session
- request body is a JSON object with a 'keys' property in the format "keys":["sessionid1","sessionid2",...]
- deletes all sessions in the keys array that are associated with username=$name
- if "*" is passed as a value in the keys array, all sessions associated with the user are deleted

Password change logic was also updated to delete existing user sessions when that user's password is changed.
You should probably call `h.PathVar("name)"` instead. Not just because it's shorter/clearer, but because it does some URL-unescaping of the result string (see the comments in rest/handler.go.)
(Same applies to other `mux.Vars` calls below.)