Associate SSO cookie with session ID to prevent session reuse

Baker's SSO cookie causes authentication to occur without the need for a valid Drupal session. This is by design and in the nature of how Bakery provides cross-site SSO. However, it can be exploited should someone steal a user's SSO cookie. Even if that user logs out of the Drupal site a request with their SSO cookie will authenticate.

Steps to reproduce:

1. Authenticate on a Bakery-enabled Drupal site
2. Save the CHOCOLATECHIP cookie (using something like the Firefox extension Cookie Exporter)
3. Log out and then import the CHOCOLATCHIP cookie
4. Request a page and see an authenticated response back

Bakery should associate the CHOCOLATECHIP cookie to the user's session on the master and check it during validation.

Related issues:
#1450842: Set SSO cookie only on master →
🐛 SSO cookie reset before authentication is complete on subsite Closed: outdated

Credit to Tejash Patel for original report on this