fix mimetypes for files loaded direct from file
set token cookie if it's not been set, not just on first auth (fixes #9)
only use 307 redirects for auth calls, other redirects should still be 302s so hitting refresh later doesn't resend POST request