Add an /auth/status endpoint

[toolness]

GET /auth/status

This CORS-only call has the same strict cross-origin restrictions as /auth/persona and returns a JSON blob similar to it too. However, instead of taking a Persona assertion, it simply uses the session cookie of the request to glean information about the current user. It returns no content if no user is currently logged in.

On its own, this isn't very useful, but if we add OAuth2 endpoints for id.webmaker.org (see also #7) and allow users to log in through it, then /auth/status can be used by the Teach site to get login info for the current user, once a user has been redirected back to it at the end of the authorization flow.