Add support for authentication by cookie.

Unless cookie key is known, any authorization response is sent
with basic authorization (login and password); if cookie key is
known, it's sent instead of h_Authorization. Authorization
change drops this knowledge.