move spf validation out of session

re-write session to work like a state machine, lots of other refactoring

Session now works like a state machine and the server functionality is
included as a feature. Lots of other cleanup related to configuration and
usability as a library.

.