Each server now gets its own session

This commit implements the following:

- each server now has a separate session with a 'sid' cookie
  scoped to /~~server:port

- 'sid' cookies are now HTTP-only and not accessible in JavaScript

- the showdown_token cookie is removed

Together, these changes fix various XSS attacks.