move things to tower_sessions::Session

- also add session mgmt
- still dbg-ing authenticated requests

This probably doesn't matter since this will be revamped into some kind
of profile page anyway.