Improve session tracking and invalidating

[labkey-adam]

Rationale

• https://www.labkey.org/home/Developer/issues/Secure/issues-details.view?issueId=51638
• https://www.labkey.org/home/Developer/issues/Secure/issues-details.view?issueId=51637

Related Pull Requests

• Invalidate sessions on password change #5994

Changes

• Fix session tracking to respect impersonation. Sessions are always tracked to the original user, not an impersonated user.
• On API key authentication, stash the API key's RowId in session. Use that to skip invalidation of API key sessions on password change and invalidate associated API key sessions on API key delete.
• Simplify creation of AuthenticationResponse

[labkey-jeckels]

@labkey-adam there are test failures related to invalid sessions. Should I review now or after they're passing?

[labkey-adam]

@labkey-adam there are test failures related to invalid sessions. Should I review now or after they're passing?

Short answer: feel free to wait. I haven't been able to reproduce these failures locally and plan to investigate (e.g., bumping up the logging temporarily). Fairly sure these are race conditions where the tests rapidly delete multiple api keys associated with the same user and/or log out / invalidate a session in parallel with deletes, but I want to verify this because previous failures like this pointed out issues with the fundamental bookkeeping. The answer is likely tolerating an invalidate() that throws, checking isValid() (which is not a public method, but seems to be on the Tomcat impl), or adding synchronization.

[labkey-jeckels]

If you make these JavaDoc style comments they'll show up in more places in the IDE