[#9] Fix persistent storage of access token

While this could probably have been fixed by increasing the php session
garbage collection time, it seems like a more reliable solution to just
use cookies. To reduce the chance of man-in-the-middle attacks, cookies
are only sent over https. In addition, their content is encrypted, so if
they are picked up by someone, using them to authenticate generic API
operations requires decrypting them. The IP limitation for the OAuth
token adds another layer of security.