Support durable authentication sessions

[Jeff Godin]

Currently, Evergreen authentication sessions are stored only in memcached, and are subject to being lost on memcached restart, failure, eviction or change in server list[1].

There would be advantages in supporting (even optionally) a durable session store where authentication sessions could live, while continuing to use memcached as a cache for those sessions.

A cache miss on a memcached GET for oils_auth_[token] would then result in a session being retrieved and cached. A negative retrieval result could also be cached, to avoid multiple "costly" retrieval attempts for an invalid session.

[1]: In theory. We may not have any sites using memcached server lists with >1 members.

[Bill Erickson (berick)]

I can confirm sites exist with multiple memcache servers. Even for sites that only have 1 server, being able to perform maintenance on a cache server without having to bring the ILS down would be nice to have.

[Jason Boyer (jboyer)]

Having learned a little bit about how memcached handles memory allocations this is likely more important than initially thought. To possibly oversimplify it: it allocates 1MB slabs and divides each into various chunk (stored item) sizes, starting at 48 bytes and increasing slowly for as many MB as it's given. an incoming item is assigned to the smallest slab whose chunk size is large enough to hold it. If you want to store a lot of items around the same size and the 1M slab that holds that size is full, the new item isn't kicked up to the next larger slab, it will just evict the lru item in the slab it's sized for. That can be frustrating when you have multiple slabs storing few / zero items but the slab that holds most of your authtokens (~680-700 bytes in the system I was looking at) starts to fill up.