Add auth refresh token

[carlgieringer]

Things to test:

• Registration
• Password reset
• Expired auth reset token redirects to login

[github-actions]

Changed-files coverage summary

=============================== Coverage summary ===============================
Statements   : 41.05% ( 1327/3233 )
Branches     : 25.24% ( 414/1640 )
Functions    : 45.69% ( 318/696 )
Lines        : 48.39% ( 1235/2552 )
================================================================================

[carlgieringer]

This PR addressed a security vulnerability where Howdju's authToken was persisted in browser localStorage, making it vulnerable to XSS. The new system uses an authRefreshToken, persisted as a secure http-only cookie, and protects the authToken from XSS: stored in-memory only and never accessible via a global JS object.

The authRefreshToken is only recognized by the GET auth-refresh endpoint, which returns an authToken. This makes the authRefreshToken safe against CSRF since no endpoint recognizing it has side effects.

Some background on this approach is here.

[carlgieringer]

The changes to PasswordResetService fix password resets. The link includes in these emails previously was not URL-encoded, and so often would not be recognized by the server.