Implement capability for dual (cookie and header) authentication

[tripsolutions]

This patch provides a very direct way to stack cookie-only authentication and header authentication. Functionality is activated by accept_header/jwt.cookie_accept_header (parameter/ini-file value) and precedence is decided by header_first/jwt.cookie_prefer_header.