Replace cookies/session module with Express-session

[FilipNest]

As different sites may want different session config for now I've made a config parameter called expressSessionsConfig that you can pass in to overwrite the default.

Any suggestions as to what the default session config should be? Cookie lifetime etc. Open to any ideas.

I put the following but it's probably improvable before this gets merged in:

{
secret: crypto.randomBytes(8).toString('hex'),
resave: false,
saveUninitialized: true,
};