s1689: switch to --token from --cookie

We decided to place the scoped token into a new header called
X-CADC-DelegationToken rather than using a cookie. This allows
us to get around encoding/decoding issues that resulted from
using cookies.
s1689: modify unit test to work with test vospace

This test was failing with a test vospace because the root
only had 7 containers, and it never exercised the limit
properly. A bandaid is to drop the limit to 2, but fundamentally
this test should probably not depend on the external service.