Switch to httpOnly JWT token

This requires a change on the backend as well, but most of the changes will be frontend.

Once we make a switch on the backend, the frontend will be unable to access the cookie from javascript. This means that we will have to remove the use of `V2.OpenAPI.TOKEN` and hope that the ajax calls will have the cookie included anyways.