auth: the session cookie lets in reads only

The cookie lets in GET, HEAD and the session's own requests; anything
changing something brings the token itself, which no page of another
site or port can make a browser send. The dashboard's writes send it.

Auth plan M3 (browsers).

1 files changed, 4 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index e3dec0b..567cebd 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -128,7 +128,10 @@ no keys (`409`).
 A browser keeps a token as its session: `POST /auth/session`, with a token, answers as
 `/auth/refresh` does and sets a cookie holding the new one (`HttpOnly`,
 `SameSite=Strict`: no script reads it, no other site's page sends it), which lets in
-requests without `Authorization`; `DELETE /auth/session` forgets it. The login page
+requests without `Authorization` that read (`GET`, `HEAD`) or renew or end the session; one
+that changes anything brings the token itself, which no other page, of another site or
+of another port of the same host, can make a browser send. `DELETE /auth/session`
+forgets it. The login page
 (`/login`, without authentication, with the dashboard) begins one by password or from a
 token pasted, from a login by key, say; the dashboard renews it while open
 ([`dashboard.md`](dashboard.md)).