Removed cookie/session to be more RESTful (issue #37). Authentication is now with a single token parameter, not both sw_uid and secret.