Added:

• header and cookie support. Check the header first, if not present check the cookie
• auto-refresh cookies on every API call, via a post-request function
• refresh token endpoint that returns a new valid token for API users
  • Not sure if this is implemented correctly, I use the auth token and not the refresh token to validate this

• test for /auth/test endpoint and cookie setting
• Config vars for setting cookies securely and preventing forgery in production

Removed:
None

Aligns with issue #2 and somewhat to #104, we only store basic information and role as an enum currently.