Collections should be tracked in the db regardless of authentication status

[jps327]

From a discussion in #297

yes, we definitely do need to rethink how sharing URLs work. The way it works right now is just not good. That is definitely outside the scope of this PR though. But in short, my opinion is that every collection should be stored in the DB. It doesn't matter if the user is authenticated or not.

If the user is authenticated, this is easier. The collection can just be linked to that user.
If the user is not authenticated, instead each unauthenticated should be given a session ID that is generated by the browser. A collection will be linked to the session ID instead. This means that we will need a new column in the collections to hold a session ID, and it should only be filled when this is an unauthenticated collection.

Now that each collection has a UUID that can be looked up in the db (regardless of whether they are authenticated or not), then we can created shareable URLs using the UUID instead of storing all the collection metadata in the URL (which as you pointed out is editable and not a useful way of persisting data).

TLDR: all collections should be tracked in the db. Collections by unauthenticated users should be linked to their session ID (generated by the browser)