Update user.js

Ok, after some digging I figured out that any request that goes to drupal needs to have the sessid token to avoid CSRF errors from the services module. This patch fixes the logout button, but the taxonomy browse is still broken.

To test this, you need to NOT be in an emulator; just use Ripple to test via a browser. Instead of using localhost, you'll need to create a subdomain for your app. So, say your Drupal site is foo.com, make an /etc/hosts entry for app.foo.com. Also, set your cookie_domain in settings.php to be ".foo.com" . This way, cookies can be set while debugging in a browser (tested on Chrome). You also might need to invoke Chrome with the --disable-web-security option to get cookies to stick.

I'm not sure if there is a higher level place to make sure that sessid tokens are sent with every request. I think the "call" method is the place to do this, but I noticed some places like logout not setting the options correctly for the token.