envelope: a signed value names its swarm

Review 3.1, part of finding 12: a signed value's payload bound path,
user, time and prev, but not the swarm. A user with the same name and
key in two swarms could have an envelope replayed from one into the
other, wherever the path holds no envelope yet (prev "").

The payload now names the swarm (`swarm`), and a node takes an envelope
only for its own. /auth/whoami says the swarm, and continuum-signed and
the example in api.md sign it. Wire version 44: nodes before this
refuse such envelopes, and those after refuse the old ones.

1 files changed, 2 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index a85dfa4..e8108e2 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -139,7 +139,8 @@ forgets it. The login page
 token pasted, from a login by key, say; the dashboard renews it while open
 ([`dashboard.md`](dashboard.md)).
 
-`GET /auth/whoami` says who a request's user is, how it proved it, and what it may do.
+`GET /auth/whoami` says the swarm, who a request's user is, how it proved it, and what
+it may do.
 
 Pages of other origins, the dashboards of other members, may call a node with a token:
 its own links (`/admin/dashboard/links/own`, and its events) and messages