Data structures and persistency for user data

[hannesm]

At the moment, we use a list. And then we iterate over it for everything we need.

We also store everything on disk. With the rise of CSRF tokens / cookies, we may reconsider and store only some things on disk.

Also, these cookies seam to be never deleted, maybe we should remove them once used (for CSRF), and when expired.

Maybe a Map data structure, or multiple maps, are useful & sensible. They may be constructed when data is read at startup, and extended when data is stored onto disk (where the on-disk format is still a list).

[hannesm]

Preparational work is done in #89 -- though this didn't change the data structures nor the data on disk.