During our BasicAuthBackend execution, we now delete all
stale sessions before performing any checks. This simplifies
our flow.

Because we have simplified session handling, we are now
required to handle stale sessions in any session-altering
code, like account edit or user login.

Signed-off-by: Kevin Morris <kevr@0cost.org>