Clarify/refactor session handling

[molomby]

Based on some discussions (and a heap of assumptions on my part) I think there are a few problems with how we handling sessions internally. Specifically:

• We currently add a user property to the express request object. This assumes/ignores the list key of the authenticated list.
• We eagerly load the authenticated item on each request.
  • Often request won't need this at all (eg. if the request is reading from a list with a list-level access control, we only need the authenticated ID, which we have already). This these cases this is a completely unnecessary DB round trip.
  • Other times, there'll be something like an like item-level access control function, that does require the item (or, at least, KS doesn't know if it needs it or not). We can detect these case and lazy-load the data then. (This relates to ACL and hook stuff.)
• When we load the auth'ed item (as above), we load the whole thing. This could also often be unnecessary. Imagine for example, user items that had a large JSON blob representing their profile info or activity history. This doesn't need to be loaded from the DB for every authenticated request.
  • Maybe we can specify a list of fields where the auth strategy is configured?

@jesstelford, @JedWatson: What are your thoughts on this? Grab me at HQ to discus?