Can cookie authentication be combined with JWT authentication?

## Summary

Right now it seems that even if I'm sending a valid JWT along with a POST /_session request, CouchDB still requires a user name in the body in order to issue a session cookie. But in this case it could very well create a session cookie and hand it back to the client.

## Desired Behaviour

By supporting JWT authentication on a POST /_session request, the JWT could be sent only once by the client and then a session cookie used subsequently for data exchange.

## Additional context

There seems to be a growing number of people being concerned about JWTs being used as session tokens by sending them repeatedly, while they're really only intended to be used as login credentials.

Start at the POST /_session authentication entry point and trace how JWT credentials are handled before the request requires a username in the body. Done means a valid JWT can produce a session cookie, with the existing cookie-authentication behavior preserved and tests covering the flow.

Written by the indexing model from the issue text.