Provide alternative to mod_session

mod_session is turning out to cause more issues than it resolves, from adding arbitrary data to a cookie, to double cookies being sent to clients, and other issues worked around previously (like bad use of encryption without authentication).

it's probably worth looking into providing a custom alternative instead, generating and parsing cookies we generated is not that hard after all.