Auth: Remove database object from user object in session

[neovive]

The Auth module currently saves the entire user object in the session after a successful login, which contains database information that even includes a full text version of the password in the embedded Database_Mysql_Driver Object (the password is removed from the main Database Object only). There doesn't seem to be a need to include any DB connection information (including username), in the browser session.

Suggestion: Create a user_session subclass for data storage that contains the database fields from the user table (user_id, username, name, roles - array, etc.). It could contain a has() method to retrieve the role from the local array instead of from the database.

[Shadowhand]

Fixed by r3021.