* Use X-JWT header for sending authentication info
both from server to client and from client to server.
* Send token in body of login response.
* Also use Set-Cookie: JWT=… so that calls that are
not issued directly by Dougal (e.g. Deck.gl layers
with a URL `data` property) work without having to
jump through hoops.
Closes#321
be5c6f1fa3