Check for active sessions & support httpOnly.

We now check to make sure the session is actually active.  This is
important because otherwise a user may log out on one domain, but retain
an invalid session cookie on the other.  This will show them as logged
out, but when they log in on the other domain they won't be
automatically logged in on the other.

We also must support httpOnly cookies, as this is the default
for Django session cookies.  We can't alter httpOnly session cookies
using the javascript shim here, so we have to re-set the session
cookie in Django if we set it via JS.