Shared cookies

@sandersonet, this is one half of the implementation I had in mind. 7da8e10756c77edbf1a87f7b788a491e5b32f93e is the relevant commit, the other commit is just Rubocop fixes and pinning the JWT version.