Add a way for SPA to request Kinto to authorize request via httpOnly cookies

The OpenID flow redirects to a page with the auth_token.

As @magopian pointed out, it is a best practice to not store the token on the client side.

The [experts told us](https://auth0.com/docs/security/store-tokens) instead to store it inside a httpOnly cookie that can be read only from the server side.

This means two things from a kinto perspective:
- OpenID should redirect to kinto and kinto should store the token in a httpOnly cookie
- Kinto should try to find the token in the cookie if not present in an Authorization header.

Trace the OpenID redirect flow and the request authorization path described in the issue. Identify where the auth token is currently returned and where Authorization headers are checked. Done means OpenID can store the token in an httpOnly cookie and requests can use that cookie when no Authorization header is present.

Written by the indexing model from the issue text.