receiver: save token in the URL as well

If the browser has no support for cookies or local storage (like Midori
in kiosk mode). This is a way to fix #7.
receiver: document the receiver storing its token in the URL as well

This is still related to #7.