Server-side state for sessions (revisited)

Thanks for your comments. After reviewing this issue a little deeper, I
agree that whether or not implementations utilize server-side state should
be left as a deployment decision of particular session authorities and
session participants. 

At the same time, it is reasonable to require that products provide the more
general functionality (ability to revoke arbitrary/all sessions linked to a
principal).

- prateek