Make WebSession an abstract interface

This permits other alternative implementations of session management,
such as a stateless token like Gerrit used to support, or an external
product that provides user identity through other means, such as SSL
peer certificates authenticated on every HTTP request.

Change-Id: I43f315f0a19968010be3437d2a0baaab79834ac7
Signed-off-by: Shawn O. Pearce <sop@google.com>

gerrit-war/src/main/java/com/google/gerrit/httpd/WebAppInitializer.java

@@ -202,6 +202,7 @@ public class WebAppInitializer extends GuiceServletContextListener {
     final List<Module> modules = new ArrayList<Module>();
     modules.add(sshInjector.getInstance(WebModule.class));
     modules.add(sshInjector.getInstance(WebSshGlueModule.class));
+    modules.add(CacheBasedWebSession.module());
     return sysInjector.createChildInjector(modules);
   }