Add JavaScript login check against the central wiki

The ability for CentralAuth to log the user in everywhere via a "push"
model is going away, as browsers tighten their security on third-party
cookies.

This changes things to a "pull" model instead. If the user is logged
out, a request is sent to the central wiki, which puts the necessary
data in memcache so we can set the necessary cookies as first-party
instead. To avoid doing this with every page view, it is instead done
just once and a cookie or localStorage token is set to remember this.

Note that, to allow Internet Explorer to be able to send and receive the
cookies via CORS or the iframe, a P3P header must be included when the
cookies are set on the central domain. The default policy used is
clearly invalid: it has no valid tokens at all, while a real policy must
contain at least an "access" token and one statement, which would
contain either the NID token or at least one "purpose" token, one
"recipient" token, and one "retention" token.

Change-Id: Ib6e9cce4fa4c5f1482c59bfac28087f558786efe