access: a token with a limit changes no credentials

A token's limit narrows every endpoint but those under /auth, which any
registered user may call. Among them, PUT and DELETE /auth/keys/{id}
change the keys the user logs in with, and POST /auth/logout ends every
token of the user. With the token a dashboard hands to another member's
(the member list, read, five minutes), its holder could add a key of its
own and log in by it as the user, with everything the user may do.

These now take a password or a token without a limit
(Need::Credentials, refused where Caps::limited). A narrowed token still
refreshes within its limit, says who it is, lists the user's keys and
ends its own session (DELETE /auth/session): a dashboard opened from
another member's logs out with it.

1 files changed, 5 insertions, 3 deletions

diff --git a/docs/access.md b/docs/access.md
index 571034e..5a1e04b 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -35,7 +35,8 @@ password hashes: every member reads the document).
   `authorized_keys` line has it (`"laptop": "ssh-ed25519 AAAA… alice@laptop"`; Ed25519
   only; the comment, 256 bytes at most, is kept and checks nothing): what it signs values with (Values signed by their users, below) and logs in with. A user
   manages its own, whatever else it may do: `GET /auth/keys`, `PUT /auth/keys/<name>`
-  with the line, `DELETE /auth/keys/<name>`; under a strict policy, by signing its
+  with the line, `DELETE /auth/keys/<name>` (not with a token that has a `limit`); under a
+  strict policy, by signing its
   entry with only its keys changed (`continuum-signed key-add laptop
   ~/.ssh/id_ed25519.pub`, `key-remove laptop`), with a key it holds already. Every
   node takes that from the user itself, as from one who may manage users. Its last key
@@ -124,10 +125,11 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store
   refreshes it past its end. A dashboard opening another member's hands it one reading
   the member list only, for five minutes ([`dashboard.md`](dashboard.md)).
 * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens,
-  by the user (`POST /auth/logout`) or by one who may manage users (`DELETE
+  by the user (`POST /auth/logout`, not with a token that has a `limit`) or by one who may manage users (`DELETE
   /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued
   before aren't taken any more. One session's (`DELETE /auth/session`, the dashboard's
-  "log out"): `_continuum/sessions/<name>/<session>`, until when the session would have
+  "log out", with any token of the session, a narrowed one too, as a dashboard opened
+  from another member's holds): `_continuum/sessions/<name>/<session>`, until when the session would have
   lasted, written by the user or one who manages users; a remake's snapshot leaves it
   out once that has passed. Without a registry, the node ending it refuses the
   session's tokens itself, until it restarts; others take them until they expire.