Add getUiViewForToken and getExternalWebSession methods to hack-session

`getUiViewForToken` is pretty straightforward. I just made `getProxyForApiToken` accessible from proxy.js and called that directly. I also added `getApiEndpoint` because I realized I need a way to tell inside an app when a request is hitting the api server and I should be using `getUiViewForToken`. Should this perhaps be hidden from apps and handled seamlessly by the backend?

`getExternalWebSession` was a little more involved. Mostly it was a reimplementation of parts of sandstorm-http-bridge.c++ in node.js. Do you think we should be passing along cookies, or should they be dropped?