AuthToken shouldn't store in cookies

[supersonictw]

As HTTP Cookie, the values will be sent in every request of hosting provider.

There will cause a concerns of security, because while getting the static files of XIA, the hosting provider can receive the AuthToken in every requests.

[supersonictw]

It will turn to use localStorage.

[supersonictw]

WIP: dffe149