Removes sessions/cookies

- Switches to random key based session auth
- Requires fewer dependencies
- No need for secure cookies
Updates package.json
Sends session key via POST body instead of url

- Updates legacy.js
- Fixes bug in timeout -- checks for presence first
Adds box-shadow