Improve session management

[jrafanie]

Session Management Improvements

The session problem occurs when UI or API requests perform dirty writes to session, causing other UI threads to miss expected tree information removed from session. Note, tree information is what we've seen so far but there could be others.

Related issue: #9515

Investigation Areas

• Make UI code handle missing session data

  • Primary concern: missing tree information
  • Risk: Tests may fail unpredictably if pages load non-deterministically (e.g., defaulting to unexpected accordion locations)

• Reduce session writes for specific requests

  • UI: Skip writing session for dashboard/widget*_data GETs #9533
  • API: [WIP] Skip writing session for all API GET requests manageiq-api#1292 (correctness uncertain)

• Minimize session modifications

  • Move TTL updates outside session datastore (no need to update TTL and tree data together)
    • UI POC: [WIP] Use separate memcahed key for session ttl #9717
  • Prevent unnecessary session writes (verify if this occurs, then implement write-only-on-change logic)

[Fryguy]

API doesn't really need the session, so IMO we should remove sessions entirely. Or more specifically, it doesn't need the UI session except in this one case [ref1, ref2] to check and see if the existing UI session can be used for authentication. That code can be rewritten to just manually look up the session (so a memcached GET only) to check it's validity, but not have it be the full session lifecycle in the request. (We also log the session_id, which would go away)