Simple authentication (Wildcard sessions)

The idea is to allow the server to modify the context:

~~~js
server.login = async function(username, password) {
if (await invalidCredentials(username, password)) {
return;
}

// `this.user` is persisted
this.user = {
username,
};

// The user is now logged-in!
};

server.getUserPosts = async function() {
// `this.user` was set by a previous `server.login` call
const {user} = this;

if (!user) {
// Not logged-in
return;
}

// The user is logged-in!

const posts = await db.getUserPosts(user);

// ...
};
~~~

~~~ EDIT ~~~

What happens here is that Wildcard sets a first cookie with the value of `this.user` and a second cookie with a signature.

| Cookie Name | Cookie Value |
|-------------------------|----------------------------------------|
| wildcard_user | {"username":"brillout"} |
| wildcard-signature_user | 60a3939232aehua12031389e99d52977e1c282 |

The signature ensures that the cookie was set by the server.

Wildcard sessions can be used to easily implement any auth strategy:

~~~js
// Username + password
server.login = function(username, password) {
if (await invalidCredentials(username, password)) return;
this.user = { username }; // Wildcard will automatically persist `this.user` by using HTTP cookies
};

// OAuth
server.oauthCallback = function(userProfile) {
// At the end of the OAuth flow, we save the user information to the context object
this.user = userProfile; // Wildcard will automatically persist `this.user` by using HTTP cookies
};

// Etc.
~~~

I've already implemented a first prototype which I'm currently using in production.

No files, tests, or entry points are named. Start by locating the server context and HTTP cookie handling described in the issue, then determine how persisted context and cookie signatures are currently represented; done should be demonstrable through the login and authenticated user examples without exposing or accepting tampered session data.

Written by the indexing model from the issue text.