converted TokenAuth to SessionAuth.

AngularJS app now depends on sessionid cookie to detect if the user is
currently authenticated. All requests after logging in are sent using
the sessionid to authenticate with the api.