Authenticate connections to web_config service

This is a fix for CVE-2014-2914 (#1438) which allows us to be more secure in the way we accept web_config requests.

I would appreciate any testing before I merge to master and Integration_2.1.1. I've tried on Debian with Iceweasel 24.7.0 (close to Firefox 24.7.0) and Chrome (36.0.1985.125).

In particular:
 - does the web config launch properly?
 - if you open the server URL (http://localhost:8001 or whatever) in another browser, do you get "access denied"?
- can you see any secrets in your process table at any time? Secrets are 32-character hexadecimal strings embedded in `/start/` URLs.
This line fails to parse cookies correctly if localhost has set any other cookie than ```com.fishshell.auth```.