Switch to httpOnly JWT token

[lmarini]

This requires a change on the backend as well, but most of the changes will be frontend.

Once we make a switch on the backend, the frontend will be unable to access the cookie from javascript. This means that we will have to remove the use of V2.OpenAPI.TOKEN and hope that the ajax calls will have the cookie included anyways.