auth: a login page and browser sessions

GET /login without authentication: log in by password or with a token
(from a login by key). POST/DELETE /auth/session keep the token as an
HttpOnly, SameSite=Strict cookie; the dashboard sends a browser
without a user there and renews the session while open.

Auth plan M2/M3 (browsers).

1 files changed, 8 insertions, 0 deletions

diff --git a/docs/access.md b/docs/access.md
index 83c39f9..cc35565 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -125,6 +125,14 @@ the signature must be by one of the user's keys, as the registry the node holds
 says, and the user enabled (`401` if not, saying why). A swarm without a registry has
 no keys (`409`).
 
+A browser keeps a token as its session: `POST /auth/session`, with a token, answers as
+`/auth/refresh` does and sets a cookie holding the new one (`HttpOnly`,
+`SameSite=Strict`: no script reads it, no other site's page sends it), which lets in
+requests without `Authorization`; `DELETE /auth/session` forgets it. The login page
+(`/login`, without authentication, with the dashboard) begins one by password or from a
+token pasted, from a login by key, say; the dashboard renews it while open
+([`dashboard.md`](dashboard.md)).
+
 `GET /auth/whoami` says who a request's user is, how it proved it, and what it may do.
 
 Pages of other origins, the dashboards of other members, may call a node with a token: