Remove global `sessions` map and use configured storage.
Add a `types` package so both `pwd` and `storage` can access without
circular dependencies.
Now the session is prepared when requested and not on load.
Images that are not whitelisted will be launched as normal containers.
Only whitelisted ones will be launched as privileged.
Additionally pull the image if it doesn't exist.