Add username cookie in authentication.py; #905

In order to have a join button on the community pages we need to be
able to hit the JSON API, which is at /username/communities.json. That
means we need the username in the JavaScript on the client side so we
can construct the URL to send to. We could use a different URL (if we
had api.gittip.com this would go away; #462). I'm not comfortable using
Tornado to interpolate the username into the page for fear of injection
attacks. Here I'm setting it in a cookie, which I'm only slightly more
comfortable with. We can't have newlines in usernames, this changeset
includes a removal of ; from the list of ASCII allowed in usernames, to
help prevent cookie injection attacks(?).