[API] sessions (⛔🖐 blocked)

At this point, we do not keep state on sessions, instead we rely on CouchDB’s auth system which encrypts username, salt, secret & a timestamp. We do not know how many sessions are currently active, and there is no way to invalidate a single session.

That’s why the following APIs are currently blocked
- `api.sessions.findAll()`
- `api.sessions.removeAll()`
- `api.sessions.on` events
