Retrieve dapp token internally

* Remove shell_requestNewToken RPC method. The token must be retrieved internally (by importing DappsRequestsStore in Parity UI), this way we can be sure that the appId is coming from a trusted source. The token, along with the appId, are now passed as query string parameters to the dapp (and to subsequent pages during in-dapp navigation)
* Use new version of @parity/api stripped of shell_requestNewToken methods that are now unused
* Use synchronous blocking methods in preload.js to maximize chances of web3/parity/ethereum objects being available directly to the dapp, before its own js executes.