Added a jwt flag for loginsuccess to return the token without the need o...

...f a redirect.

This is in response to #39 and seems a bit cleaner to me, then having to have a redirect, which adds the need of a session.
I didn't change anything how waterlock creates a session, but this new option should theoretically reduce the need of a session. Anyway, that is how you use it:
```
postActions:{

    // post login event
    login: {
      success: 'jwt',
```

Returns the same thing as if you would access `/user/jwt`