Add support for session in AppClient for tests

Nobody has claimed this yet.

I want to test so the browser actions are return right status codes if logged in and not logged in.

Now the app client only set authorization header, so it is only made to work for the API. I would like to have some support to auth a user for browser action as well.

Been trying to something like:
```crystal
class HtmlClient < Lucky::BaseHTTPClient
def initialize
super
headers("Content-Type": "text/html")
end

def self.auth(user : User)
session = Lucky::Session.new
session.set(BrowserAction::SIGN_IN_KEY, user.id.to_s)
cookie = HTTP::Cookie.new(Lucky::Session.settings.key, session.to_json)
new.headers("cookie": cookie.to_cookie_header)
end
end
```
But it won't work as the cookie is set incorrectly.

While looking into the code, lucky have backdoor test for the user. But it seems to be only for LuckyFlow?

Trace how Lucky::BaseHTTPClient handles authorization and how Lucky::Session serializes cookies, then compare that with the existing LuckyFlow backdoor test support and BrowserAction::SIGN_IN_KEY usage shown in the issue. Define support for authenticating browser actions in tests, and verify that logged-in and logged-out requests return the expected status codes.

Written by the indexing model from the issue text.