Further fixes to universal variable server socket management

- Change fishd_path to std::string
- Warn, rather than exiting with an error, if the universal variable
  server path is not available, and provide more useful advice.
- Export the new __fishd_runtime_dir variable.
Documented Alt-Right to accept a single word of an autosuggestion

See https://github.com/fish-shell/fish-shell/issues/1262
Authenticate connections to web_config service

 - Require all requests to use a session path.
 - Use a redirect file to avoid exposing the URL on the command line, as
   it contains the session path.

Fix for CVE-2014-2914.
Closes #1438.