Change in forbidden_view_config in Pyramid 1.5a3

If forbidden_view_config is passed a context, it raises an error, it
used to instead override whatever the user provided with HTTPForbidden.

This behaviour has changed, and means it is no longer compatible with
the way I was using it along with @view_defaults().

Updating to use @view_config() which does work, and causes no further
side-effects.
Fix typo
Update Authentication Policy to use SignedCookieProfile

Instead of using the home baked version, we use the one provided by the
new and improved WebOb.
Remove CookieHelper class after it was ported to WebOb

There is no use for having the CookieHelper class still stick around, it
has since been imported into WebOb with some changes as
SignedCookieProfile.
WebOb version 1.3 introduces .domain on a Request

This means we no longer need this in our own app.
The keyword argument changed from http_only to httponly
Use the request property for unauthenticated_userid
Add some padding ...
Use request property for authenticated_userid