better login/session support

 * don't depend on component/querystring or component/assert
 * remove setToken and setEndpoint. just set the properties
 * add loginUrl property
 * add login() and logout()
 * add saveSessionCookie() and loadSessionCookie()
 * token is present in every lydianGet request
add loginMiddleware server only export and add test
fix saveSessionCookie
logout: wait a tick before calling cb
Merge pull request #8 from indabamusic/andy

better login/session support