* Simplify Web UI sessions
Remove all of the hacks and support infrastructure around Rack sessions. Rails provides this by default so we don't need it for 95% of users. The other 5% need to provide a Rack session.
This is a big change and has the potential to break installs so it deserves at least a minor version bump.
See also #4671, #4728 and many others.
1. Remove unused methods
2. Remove unused and unnecessary features
3. Add basic tests
The session token is stored server-side and never given to the client.
A masked token is generated for each request which can be inserted into forms to be POSTed.
