Prefer database for session storage

[Bodacious]

As described in the Rails documentation, it's safer for us to use server-side session storage than browser-side:

One possibility is to set the expiry time-stamp of the cookie with the session ID. However the client can edit cookies that are stored in the web browser so expiring sessions on the server is safer. Here is an example of how to expire sessions in a database table. Call Session.sweep("20 minutes") to expire sessions that were used longer than 20 minutes ago.

[magdalenadrafiova]

@briri @xsrust is this still something that we want to consider?

[briri]

yes, I think this would still be a good idea. We can investigate the recommended approaches for Rails 5.2 or 6. What do you think @xsrust?

[xsrust]

Agreed, This sounds like a good idea for a future refactor, but not a priority