Function create_session 

pub async fn create_session(
    pool: &PgPool,
    user_id: Uuid,
    ttl: Duration,
    how: SignIn,
) -> AppResult<String>

Creates a session and returns the plaintext token for the cookie; the sign-in is recorded in the audit log (user.sign_in, never the token).