This is to prevent race conditions with token refreshing

- Only refresh session on API calls to blaise, not static asset loading
- Don't check session expiry if the button being clicked is save and
  sign out
- Use redis backed session management for user session
- Use cookie backed session for CSRF
- 30 day expiry for CSRF
- 1 day expiry for all redis backed session data
- Add seperate session validation session to ensure refreshed tokens are
  not valid after logout - fixes race condition where the JWT is both
  cleared and written and the same time (within the same ms)