send server-based accesstoken to .js instead of MyPlex authorisation.

- add new special char to {{VAL}}: % to access PMSProperty, might even
be used to replace {{PMSNAME}}, {{ADDR_PMS}}
- rework application.js to better show we are using server-based
accesstoken