mixin

There are plenty of if not something then panic code, refactor them with general functions, but try to avoid reflect.

add a category in the sessions table, the normal sessions should expire after 6 hours, but the api session won't expire, and the expiration time is the only difference between them.

add a button to generate a new API session, and whenever a new API session created, expire all old API sessions.