Fixes #315. Mitigate CSRF vulnerability by using non-cookie auth

Cookies are no longer sufficient for authenticating a request,
we use the nonstandard "Girder-Token" header instead.