`logger` is a closure here, so overwriting it on every request isn't a good idea.

It's easier to use and set up than logrus, and the API is a bit nicer
(no distinction between a logger and a log entry, for example).

This way, failed authentication also has a request ID and such

If a commit fails, we return its error as the error of the function that called it.

If we're behing a proxy such as Caddy, the remote address will be that
of the proxy, so we have to use the X-Forwarded-For header that the
proxy injects instead.

This makes it easier to re-use the session after a while, and to
implement a logout option (by just deleting the session)