switch to VOS tokens, don't need to urlencode

The final solution for VOS scoped tokens is to use a header called
'X-CADC-DelegationToken' rather than a cookie, which avoids problems
related to encoding/deconding.
add condor_submit wrapper that also does VM image sharing