Server should report its capabilities to clients

[JeanMertz]

When #19 lands, it will be something you can opt into (eventually, it might be mandatory at first).

By allowing the clients to request the enabled server capabilities, it can show or hide specific features.

For example, if there is no authentication and server-side user-state enabled, clients can store the user state locally (in a cookie, for the web client), to still provide the functionality described in #9 and #10, without supporting cross-device session state.