API authentication: implement authentication with both token and session cookie at the same time.

[dmitrybelyakov]

This should be used by the clients capable of executing javascript to prevent XSS and CSRF attacks.

Or use CSRF cookies (reachable by Javascript, httponly off). See Angular Cross Site Request Forgery (XSRF) Protection