Authenticate connections to web_config service

 - Require an authentication cookie for all requests.
 - Add a '/start/' handler for setting the authentication cookie.
 - Use a redirect file to avoid exposing the '/start' URL on the command
   line, as it contains the cookie value.

Fix for CVE-2014-2914.
Closes #1438.