deprecate pickleable sessions, recommend json

[mmerickel]

This change is backward-compatible but emits deprecation warnings when using the default PickleSerializer with SignedCookieSessionFactory.

I was also going to deprecate it in UnencryptedCookieSessionFactoryConfig but that entire thing has been deprecated since 1.5 and is definitely getting removed in 2.0 wholesale, so there's no point in deprecating a small part of it.

replaces #3341
related #2709

[digitalresistor]

👍

[jvanasco]

I like the example 'pickle fallback' code, but i think it would make sense for the docs to list some of the common objects that not JSON serializable (namely Datetime) and show an example JSON encoder/decoder using object_hooks to enable it. I imagine this would pre-empt many questions, and serve as a resource to point people having trouble to.

The renderers documentation (https://docs.pylonsproject.org/projects/pyramid/en/latest/narr/renderers.html) does something similar, however it uses the standard serializer and add_adapter.

[mmerickel]

i think it would make sense for the docs to list some of the common objects that not JSON serializable (namely Datetime) and show an example JSON encoder/decoder using object_hooks to enable it.

I'm not interested in doing this. Feel free to submit a PR and I'll evaluate it but I have no intentions of supporting this type of stuff in the default json serializer on my own.

[stevepiercy]

@jvanasco your PR may be useful as a recipe in the Pyramid Community Cookbook, if not in Pyramid's docs, or you could blog about it, and Pyramid docs could have a link to it.

[jvanasco]

ok, i'll generate a PR for some docs once this ticket closes out. I don't think the default serializer should handle datetime/etc natively; but i do think the docs should instruct users on how they can extend the session serializer to handle other objects - especially if pickle is being presented as a fallback.