mostly auth fixes, but more:

- canceling holds only needs to happen once. was binding a *second*
  onclick event to the confirmation button, so it was firing twice.
- change logged_in to look for token *or* username (for now --
  eventually, just token)
- make hold_partB use acctinfo (with token) instead of login (with
  user/pass)

Signed-off-by: William Rockwood <wrockwood@tadl.org>