More CORS nonsense.
Now the origin will always be the same as the origin that was sent in the request! How convenient for credential requests that don't permit * origins.
We even do it all from a message inspector, so it's transparent to the endpoints
Converting the authorization header passing of session token to cookie based.
It was surprisingly simple.
Some refactoring of the web utilities to better support the cookie method.
Also adding functionality to invalidate old sessions if a user is logging in a second time.
Fixes #16