Size of client-side sessions

[Cantor, Scott]

I have working code that stores the V3 user session, including a variable
number of authentication results for SSO, in a cookie. With some
additional optimizing, the URL-encoded form after encryption and
base64-encoding is only 472 bytes for a session plus one password-based
authentication result.

Most of that is the authentication result, so storing additional
factors/methods in a session is probably ~400 bytes typically unless a lot
of custom data were involved, which is best avoided for this use case.

Some more shrinking is possible, plus this is using JSON, so it's still
text based and could be smaller with a binary encoding.

All in all, I think we've got a workable plugin.

Swapping between client-side and server-side stores is just a simple
property switch.

-- Scott