RPC cookie authentication spec sketch.

Part of #1521.

Please let me know what else you think this should cover. It is much less urgent than !2439 (merged) .