Add an ability to configure if a secure server should supports authentication with a cookie or not

[sleshchenko]

Description

Add an ability to configure if a secure server should supports authentication with a cookie or not.

It is related to Cross-Site Request Forgery(CSRF).
CSRF attack is possible only if:

• cookie authentication is used;
• a Server provides API that has modifying methods which can be invoked by submitting a form;

As an example of an application that CAN use cookie authentication without any additional CSRF protection is Theia application. It has one non-modifying endpoint for loading a client and another one is WebSocket endpoint for communication between Client and Server sides. Both of them can't be attacked by CSRF.

As an example of an application that CAN NOT use cookie authentication without additional CSRF protection like using CSRF token is any web application that has methods which accept GET and POST requests with any of form supported content types.

So, to protect secure servers more it is needed to:

1. Add an ability to configure if a secure server should supports authentication with a cookie or not. It can be done with the corresponding attribute in the server config. If the attribute is absent then it is supposed that authentication with a cookie is forbidden.
2. Modify JWTProxy to make it possible to configure:
   2.1. Fetch or not token from cookies.
   2.2. Redirect or not a user on loader page that will set cookies or just respond 403 in the case when a token is absent or invalid.

[sleshchenko]

Update: exec-agent is removed as the example of an application where authentication with cookie must be forbidden because it doesn't have any modifying GET or POST methods which accepts html form supported contents types.