add HTTPCookieAuth for token auth in req cookies

This allows users to create a `HTTPCookieAuth`, which is used like `HTTPTokenAuth`, but reads the token value from a cookie in the request instead of from an HTTP header. Using a cookie with `httponly=true; samesite=strict; secure=true` flags can be more secure than reading from an HTTP header because the browser will never allow JavaScript to read the token, which defends against XSS attacks sending the token to other servers. It is just sent automatically by the browser along with any request to the site which set the cookie.