Fix track playback for anonymous sessions

[adammw]

Uses the Facebook account login flow to get track playback to work in anonymous sessions. See my comment on #58 for more details.

Also adds Track and Time Cap error codes, when the (anonymous) user has used up all the free tracks they can play without signing in.

While testing, I also noticed that anonymous sessions themselves are also ratelimited and the auth endpoint will return an error if your IP address tries to get too many sessions in a small window of time.

Currently the auth endpoint returns a 500 error when requesting an anonymous session the first time, so there's extra logic to do a retry, as it usually works afterwards. Superagent doesn't seem to save the cookies returned when the status code is 500, otherwise the second auth request would not be required as the landing page will have the credentials needed. Not sure how to fix that, but it still works anyway as the auth response sets the already_authenticated error and gives us the credentials we need anyway.