XSRF protection

@cpatrick this also includes your proposed change of changing our cookie format to just be the token string rather than a json object. This will simplify the task for clients.

Cookies are still used to automatically persist the session token on the user agent, however clients must explicitly pass the `Girder-Token` header set to the token value in order to make authenticated requests. This will mitigate vulnerability to CSRF attacks.

I plan to change this in the python client as well ( @scottwittenburg I know you had difficulties with the json-encoding in the cookie, that will now no longer be a problem).