Add long-term cookie-based authentication for remembering user.

The cookie data is not derived from the user's password for
security reasons. Also added a helper method for getting the
user from the session or the cookie to rest.Resource.