Support graceful fallback to cookies

[ekryski]

Currently when using OAuth, in order to get the JWT we generate back to the client, we shove it in a cookie called feathers-jwt. The client then parses the JWT from the cookie and uses this JWT to authenticate with the API going forward.

In theory, in addition to checking the Authorization header, query sting, or request/socket body we could also check the feathers-jwt cookie to see if it is expired and if not grab the token.

Now that I think about this, this is actually pretty easy and should just be a couple lines added right in this middleware.

[ekryski]

This is now done in the decoupling branch now. It doesn't support cookies on sockets however...