Improve login and cookie handling

[line-o]

Please have a look at the documentation for the new feature: https://github.com/eeditiones/roaster/blob/3b0ab4e867a21683bb00b93ab0be7809b6200887/doc/cookie-auth.md

FEATURES

• allow and encourage custom login route handlers
  • read user name and login from any body or header content including XML bodies
• allow and encourage custom logout route handlers
• allows setting HttpOnly and SameSite attributes on login domain cookies (implementation in content/cookie.xqm)

FIXES

• no redirect needed for logout, nor logout=true
• do not attempt to login on every request
• get rid of hard-coded field names user, password