Switch from cookies to bearer tokens

This PR takes the auth token from the couchdb cookie and exposes it as a bearer
token at the HAPI level:
* When couchdb sets a cookie, it is stripped, and the authToken is added to
    the JSON body.
* When a request comes in, the 'Bearer ...' token is read from the Authorization
    header, and converted to a cookie for couchdb.

This happens at the hapi level.
The solution is based on https://github.com/spumko/hapi/issues/1637
and https://github.com/spumko/hapi/blob/master/docs/Reference.md

TODO:
* [x] <strike>create a couchdb mock in the test framework</strike> (added test/unit/api-plugin-test.js)
* [x] use this to create a test for the `mapProxyPath` function
* [x] use this to create a test for the `addCorsAndBearerToken` method
* [x] add tests for the `extractToken` function
* [ ] fix tests that rely on callback being called
* [ ] fix clashing of integration test suites that both start couchdb on port 6006
can you please make `Access-Control-Allow-Headers` dynamic, based on the request coming in, just like you do for `Access-Control-Allow-Origin`? Otherwise plugins with hooks depending on own headers won't work with CORS