Move to using Rails `session` cookie for user ID source

[rdmurphy]

It's possible Klaxon just predates this being a thing, but there's no reason for us to use cookie[:user_id] — this is what the session cookie is for.

[rdmurphy]

Actually now I see it's this way for persistence reasons. 😅 Still could be tidied up.