New authentication system, other innovations

PHP Sessions aren't used any more to keep track of authentication.
Instead a token is returned after a call to the auth module login()
which is then sent with any subsequent call. The auth token is meant
to be the primary means of interacting with Dandelion for first-party
modules and interfaces. Third-party extensions and calls should continue
to use the external API and send an API key on each request. This
will relieve developers of having to manage a logged in session which
should only be done by the Dandelion Client.