also tweaked the session code to allow session types other than standard HTTP cookie-based sessions. The XML-RPC code doesn't do anything interesting yet.
