'Persisting logins' was a glorified intro anyway

Only up to the original login process

Reordered setup code blocks for easier content flow.
Decided to introduce the session store and secret explanations here
instead of their own sections later on (not really needed there).

New order allows for a more natural way of explaining how
express-session populates req.session.
That can be explained at the start and options explained to reflect
that, instead of explaining options in a bit of a black hole then
provide the context later in the lesson.

Made more sense to talk about logging out after logging in, then talk
about password hashing afterwords.

Use subsections for better content organisation and linking

"Session-based authentication" is a more appropriate title for the
lesson than just "Sessions", given that sessions are not exclusively
used for auth purposes.

Makes sense to showcase them directly rather than just via text example after the fact

Prevent timing attack

Prevent confusion with POST as an HTTP verb