Fix user authentication.

* Use X-JWT header for sending authentication info
  both from server to client and from client to server.
* Send token in body of login response.
* Also use Set-Cookie: JWT=… so that calls that are
  not issued directly by Dougal (e.g. Deck.gl layers
  with a URL `data` property) work without having to
  jump through hoops.

Closes #321

lib/www/server/api/middleware/user/login.js

@@ -6,8 +6,10 @@ async function login (req, res, next) {
 		const {user, password} = req.body;
 		const payload = await jwt.checkValidCredentials({user, password});
 		if (payload) {
-			jwt.issue(payload, req, res);
-			res.status(204).send();
+			const token = jwt.issue(payload, req, res);
+			res.set("X-JWT", token);
+			res.set("Set-Cookie", `JWT=${token}`); // For good measure
+			res.status(200).send({token});
 			next();
 			return;
 		} else {