Implement IIIF Authentication 1.0 using postMessage

[cbeer]

SPEC: http://iiif.io/api/auth/1.0/

Stacks currently implements IIIF Authentication 0.9.1 (similar or identical to the "2.2.3 Interaction for Non-Browser Client Applications"). To support Universal Viewer, we need to update to IIIF Authentication 1.0 with support for "2.2.4 Interaction for Browser-Based Client Applications".

If the messageId parameter is present, our iiif_token#create action should respond with the text/html as documented in the spec.

(Note that the sul-embed IiifAuth client implementation is currently nonconformant with the latest 0.9 spec because it lacks the required origin parameter: sul-dlss/sul-embed#750)

Once implemented and deployed, maybe http://universalviewer.io/uv.html?manifest=https://purl.stanford.edu/yh887qk5737/iiif/manifest.json#?c=0&m=0&s=0&cv=0 will work as expected?