check_*_referer should be able to look for nonce in any query parameter

[mdawaffe]

Adding an optional parameter to check_admin_referer() and check_ajax_referer() allows more than nonce to be generated on one page, increasing the flexibility of nonce checking.

It also allows us to get rid of the problematic cookie code in check_ajax_referer() and to rely solely on nonces.

Attached:

1. Adds parameter.
2. Converts autosave to use nonces for verification (the last holdout?).
3. Removes cookie code from check_ajax_referer(). Good for core (we can make sure all of our other ajax actions use nonces). May break some plugins.

[mdawaffe]

s/more than nonce/more than one nonce/

[ryan]

(In [6739]) Remove cookie checking from check_ajax_referer(). Check nonces instead. Props mdawaffe. fixes #5782