discourse: Add session setup and teardown, and CSRF support, to the client

API keys are all well and good, but using actual credentials can be even better.
If you're going to be POSTing, call session_csrf and pop it into :csrf_token; if
you want to log in, call session_create with a username/email/at-name and password
(the only supported mechanism).

CHECK THE POST RESPONSE. A failure is a HTTP OK with a json hash as the body,
including an 'error' member.

Once logged in successfully, the cookies will be automatically used for any
future requests for that instance, or you can store them elsewhere and put
them into new instances. Lovely.