new digest-auth-nocookie route and improved robustness of digest-auth

This adds a new route (`/digest-auth-nocookie`) that skips the cookie written at the 401 authentication requests. Additionally it fixes username checking, avoids some cases that were causing crashes (500 responses), and does a better job of reporting missing cookies as well as crashes (500 responses).
Because there were problems in the digest checking helper that were resulting in 500 errors with no information. By adding this we get more information. The ones I ran into I fixed or made clear what the problem was, but the next person to find more will not have to dig so much.