Adds Cache-Control: no-store and an X-Dev-Site header to the dev site
switcher so a browser cannot reuse another site's page or redirect, and
the selected site is visible in dev tools.
The cookie is shared by all tabs and redirects dropped ?site=, so opening
several sites made them all show the last one. The site is now taken from
<domain>.<anything> hosts (each site its own origin), with ?site= and the
cookie as fallback, and redirects keep ?site=. /dev-sites/ links use the
per-site hostnames, via sslip.io when accessed by IP.
With DEBUG on, ?site=<domain> selects the site without DNS or hosts
entries and is remembered in a cookie. /dev-sites/ lists all
configured sites as links.
