Make WebSession an abstract interface

This permits other alternative implementations of session management,
such as a stateless token like Gerrit used to support, or an external
product that provides user identity through other means, such as SSL
peer certificates authenticated on every HTTP request.

Change-Id: I43f315f0a19968010be3437d2a0baaab79834ac7
Signed-off-by: Shawn O. Pearce <sop@google.com>
5 files changed