Use query string for shared secret token instead of cookie

Cookies are same-origin only and can't be used by a packaged app.
`_user` because we don't want to conflict with existing query params.