Session cookie approach

Trying to use the Session Cookie approach recommended by the AngularJS project. It works for the login but then starts failing. Spring Security generates a new XSRF token after the login, and it sends it to the browser in the cookie. But Angular only reads that cookie once on the first request, and never checks for a new value.

So to get this to work we'd still have to modify AngularJS code to reload the new XSRF token. Or find a way for Spring Security to not change the XSRF token value.

For these reasons the best is probably to just use the CSRF Token in Response Headers approach. But I'll leave this pull request and commit info here for explanation reasons.