Features/cookieless

Drops cookie requirement from the bookmarklet. I've also removed CSRF because that implicitly requires cookies.

The new session handling code requires that we're running SSL and I expire the session in 10 minutes.

This ought to fix our cookie issue for everyone who doesn't have 3rd party cookies enabled - which will be most people.

cc @kynan @loleg @JosephMcArthur @davidecarroll