remove InMemoryUserRepository

[scionaltera]

Removed the hacky InMemoryUserRepository in favor of attributes in your HTTP session, which opened up a whole different can of worms.

I found a bug where Spring Security and Spring Session and Spring Websocket don't play well together.

Spring Security rotates your HTTP session ID after you authenticate, but your Principal still has your old session ID. So when you go to use a SessionRepository or SessionRegistry to find your session, it won't be there because you're asking for an old invalid ID. So... I added SessionIdUpdatingHandshakeHandler that will build you a new WebAuthenticationDetails with your new session ID in it before releasing your Principal into the wild. Now the session IDs all match up and everybody's happy.

We're back to using the original Principal with the "loginwithamazonblahblahblah" name instead of session IDs now too. The names are the same but the HTTP session IDs are different and of course the WebSocket session names are different too, so we can still tell multiple browsers apart and avoid accidentally broadcasting messages to both.

Fixed the short session timeout to 24 hours.

Refactored Question so it's aware of its bean name. We move between Question instances by bean name which means they can be singletons but they do need to be stateless. I think that's OK. If it isn't we can try something fancier like session scoped beans and see where that takes us.