Add some hacks to support pure HTTPS for WebAdvisor XSS automatic registration hack.

Instead of using a JSONP callback and PHP sessions to store the
TOKENIDX, the XSS script now just updates the URL parameter for the
WebAdvisor login page so that the TOKENIDX will be transferred to
webadvisor.php by a GET variable right when it is needed instead of
asynchronously.

A separate hack to help support HTTPS is that automatic uploading of
assets to Amazon S3 (which has HTTPS access) allows the XSS script to
be served over HTTPS. This eliminates the browser warnings about
accessing mixed secure/insecure content and, thus, hopefully supports
browsers which automatically block insecure content on secure pages.

Fix the support for automatic WebAdvisor registration to not enter infinite loops.

The automatic registration process used to enter an infinite loop
every time it was used if the user had been previously issued a
TOKENIDX by WebAdvisor. This means that it would work the first time
in most cases but rarely a second time, if ever. Now we use
LASTTOKEN=NULL instead of TOKENIDX= to request a new token and it
works pretty well.