remove cookie support

[EECOLOR]

The scenario where you want to combine two authorization schemes is invalid. Browsers (when using basic auth) will send an Authorization header with each request. If the client code also uses an Authorization header the result is unpredictable. The RFC does not allow multiple authorization schemes using the Authorization header.

This will be a non-backward compatible change as applications would need to switch to X-Authorization or something similar if they wish to combine with basic auth.