new digest-auth-nocookie route and improved robustness of digest-auth

This adds a new route (`/digest-auth-nocookie`) that skips the cookie written at the 401 authentication requests. Additionally it fixes username checking, avoids some cases that were causing crashes (500 responses), and does a better job of reporting missing cookies as well as crashes (500 responses).