Handle persistent login better

[jonscheiding]

Persistent login doesn't work because we're on Heroku, and the app goes to sleep and loses the server-side session state. We'll need to use something else for session store if we want to make it work. Look at cookie-based or Redis options.