Improve session token storage

[haku]

currently these are stored as files in a directory, which is not great.
this should be moved to a sqlite file, which can go in the same dir for ease of migration.

long term goal is to also support oauth from an external provider.

[girlpunk]

May want to consider utilising JWTs, which wouldn't require storing the tokens at all