Bind session handling to request lifecycle

With this change, session objects are no longer instantiated
globally, but instead created within a middleware during the
request lifecycle.

In addition, session garbage collection is integrated with
the already existing middleware for this purpose.

src/User/UserServiceProvider.php

@@ -15,7 +15,9 @@ use Flarum\Event\ConfigureUserPreferences;
 use Flarum\Event\GetPermission;
 use Flarum\Foundation\AbstractServiceProvider;
 use Illuminate\Contracts\Container\Container;
+use Illuminate\Session\FileSessionHandler;
 use RuntimeException;
+use SessionHandlerInterface;
 
 class UserServiceProvider extends AbstractServiceProvider
 {
@@ -23,6 +25,26 @@ class UserServiceProvider extends AbstractServiceProvider
      * {@inheritdoc}
      */
     public function register()
+    {
+        $this->registerSession();
+        $this->registerGate();
+        $this->registerAvatarsFilesystem();
+    }
+
+    protected function registerSession()
+    {
+        $this->app->singleton('session.handler', function ($app) {
+            return new FileSessionHandler(
+                $app['files'],
+                $app['config']['session.files'],
+                $app['config']['session.lifetime']
+            );
+        });
+
+        $this->app->alias('session.handler', SessionHandlerInterface::class);
+    }
+
+    protected function registerGate()
     {
         $this->app->singleton('flarum.gate', function ($app) {
             return new Gate($app, function () {
@@ -32,8 +54,6 @@ class UserServiceProvider extends AbstractServiceProvider
 
         $this->app->alias('flarum.gate', 'Illuminate\Contracts\Auth\Access\Gate');
         $this->app->alias('flarum.gate', Gate::class);
-
-        $this->registerAvatarsFilesystem();
     }
 
     protected function registerAvatarsFilesystem()