rpc: authentication and basic handle manipulation

This branch implements our pre-authentication functionality, changes the object returned by authentication into a "session", and adds functionality to drop or downgrade strong references.

See comments and commit messages for some interesting open issues.

part of #840 (closed).