Update and improve the documentation on Testing

**Node version**:
**Sails version** _(sails)_:
**ORM hook version** _(sails-hook-orm)_:
**Sockets hook version** _(sails-hook-sockets)_:
**Organics hook version** _(sails-hook-organics)_:
**Grunt hook version** _(sails-hook-grunt)_:
**Uploads hook version** _(sails-hook-uploads)_:
**DB adapter & version** _(e.g. sails-mysql@5.55.5)_:
**Skipper adapter & version** _(e.g. skipper-s3@5.55.5)_:

Basically, the title. After going through the course on Platzi, looking at the Ration.io source code and the official documentation I don't think I ever really had a decent testing setup run the way it probably was expected to for this framework. The closest I got was following this blog by Kevin, https://blog.sailscasts.com/testing-sails-applications-with-mocha-and-supertest and that blog post is for a Sails JS API with no front-end option set.

Looking specifically at the official documentation on the website, if you need to test with a front-end there's no mention of disabling the CSRF in the test environment or creating a fake endpoint to get a cookie and the CSRF as shown in the ration.io source code. So if you are brand new, you can end up with 403 or 401 on a 200 request because of not having a cookie or the CSRF token present both of which aren't mentioned in the official documentation on the website. There are also a lot of baked assumptions in the documentation themselves which can make it hard for anyone starting out with the framework to figure out what is really happening behind the scenes in the testing environment. At bare minimum the documentation should be able to provide a developer with a simple setup and be able to handle authenticating a user and doing something with that authenticated user (like viewing a restricted page) if they have the front-end generated for the application.

Review the official Testing documentation alongside the linked Sailscasts Mocha/Supertest article and the ration.io source example. Improve the guidance for a front-end-enabled testing setup, including CSRF cookies/tokens and authenticated-user flows; done means a newcomer can avoid the described 401/403 failures and test a restricted page.

Written by the indexing model from the issue text.