Add improved user session handling

[KowalskiPiotr98]

#19 added only a very basic session handling, namely: as long as you have a cookie that looks valid, you're good.
It's not terrible, as it uses some sort of encryption, but it lacks useful features like session invalidation, listing all user logins, and so on.

A much better approach would be to use something like Redis to store user session details, and just issue session ids in the cookies instead.

The only caveat here is that all Redis libraries for Gorilla sessions are less than great (mostly because they smell unmaintained), so that will most likely require own implementation.