Questions and answers of affected sessions are now deleted.

Lists of visited sessions for guest users which have not been active for
a fixed amount of time are now automatically deleted.

The cleanup is now disabled by default and can be set up by uncommenting
the configuration parameter `session.guest-session.cleanup-days`.

This reverts commit 3e969181.

This reverts commit 5f5699c5.

The backend wrongly trusted user input allowing the circumvention of
access control checks.

Tests failed because they did not allow a charset parameter in
Content-Type headers.