sakaiproject/Hilary — pull request #398 by mrvisser (2013-03-01 12:15:34+00:00)
Title: Using cookie session instead of redis session.

* Pro: Redis server can now have an eviction policy
* Pro: Smaller deployments can have activity and main redis together
* Pro: Cuts down one redis request per API request
* Pro: Not forced to have an absolute TTL on sessions

Con \#1: We have to decrypt the user id from the cookie every request.
Probably better than doing the Redis lookup on every request, though.

Con \#2: Without an absolute TTL, cookie could be hi-jacked indefinitely
(until private key changed). Only difference here between Redis impl is
that the redis cookie will expire eventually. Could attach a timestamp to
cookie and inspect refresh every so often (e.g., setting a new cookie
every 30min would require users to make a request at least every 30
seconds lest they lose their session). This is a classical UX-security
balance that needs to be made, and can be discussed more later.