Fix the cookie handling and CSRF errors!

* Use the newest request
* Let wsapi_client do all of the cookie handling.
* point getSessionContext directly to wsapi_client.getSessionContext
* Do not allow request to use the built in cookie jar, it will cache cookies across requests by default - we don't want that.
* request has a bug where cookies defined in its cookie jar will overwrite cookies defined on the Cookie header. Change this to cookie (lowercase) to avoid the problem.

fixes #37
fixes mozilla/browserid#3037
relax restriction on audience; allow any protocol