Improve contact request payload and security

The client side of a request now uses a signed SHA256 digest of the
entire request to verify its identity, rather than signing the
server-provided cookie directly.

The server's hostname is also included in the request, to prevent a
(real-time) forwarding attack.
Review and clean up ContactRequestServer code