Store hashed session ids

Session IDs are now hashed in storage (`tabSessions` and cache); only the client cookie holds the raw sid, so a database breach no longer exposes active session tokens.