send cookie on successful basic auth

[rnewson]

As a way to migrate users to a strong password hashing scheme without getting a performance hit each time, assuming the client will send back the cookie we send them. we check the cookie first and avoid the hit, but we still fall back to basic auth if necessary

h/t @glynnbird for the idea

[big-r81]

Don't we need to do more than juste create the FullSecret, like checking the cookie?

[rnewson]

@big-r81 The PR sends a cookie, there isn't one in the request to check yet. If there was the cookie auth handler would have done so.