cookies need refining. timed out session leaves old cookie info intact.

[rugbyprof]

I'm thinking that we screw cookies, and manage sessions from the db. only log tokens (sessionIDs) as a cookie. Thoughts?