rpc: authentication and basic handle manipulation
This branch implements our pre-authentication functionality, changes the object returned by authentication into a "session", and adds functionality to drop or downgrade strong references.
See comments and commit messages for some interesting open issues.
part of #840 (closed).