Add custom session strategy example

[dcousens]

This pull request adds a custom session strategy example.
The example shows how to implement a simple session strategy for authentication, using a cookie.

The session strategy, sillySessionStrategy, is a demonstrative example acting as a starting point for implementing your own session strategy. The Cookie:user={user_id} format used in this example should outline the moving parts of an implementation, but it is by no means actual authentication. In practice, you should use actual authentication, such as OAuth or JWT.

You can pass a cookie with the format Cookie:user={id} in your HTTP requests, and the strategy will extract the id from the cookie and look up the corresponding user in the User list. If the user is found, the strategy will return a session object with an id field and an admin flag.

[dcousens]

Separate to this, which is a rather arbitrary sandbox example that is fun to play with to learn how custom session strategies can work, we should add a custom-session-jwt as a more concrete example.

This pull request will hopefully be simplified and easier with #8097