feat!: add cookie authenticator

removed credentials: "include" by default. Supply your own CookieAuthenticator to handle cookies on cross domain.

Linked to cubicweb#1067 (closed)