auth: logging in, and tokens as bearers

POST /auth/login (by htpasswd or the proxy), /auth/refresh,
/auth/logout, GET /auth/whoami; every request may bring
Authorization: Bearer instead of a password. --token-lifetime and
--session-lifetime.

Auth plan M2.

1 files changed, 3 insertions, 2 deletions

diff --git a/docs/api.md b/docs/api.md
index 5486378..8c4a534 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -31,9 +31,10 @@ curl -u alice:secret -X POST 'localhost:3000/store/stats/visits?increment=1'  #
 * Bodies are JSON (`application/json`, the default), text (`text/plain`, stored as a
   string), or a value of a type of its own (Types); answers are JSON, or as `Accept`
   asks. Numbers in JSON are stored as integers where they fit, as floats otherwise.
-* Every request needs a user from the node's `--htpasswd` (basic authentication), or
+* Every request needs a user from the node's `--htpasswd` (basic authentication),
   named by a reverse proxy in front that authenticated it (`--user-header`;
-  [`operations.md`](operations.md), Behind a reverse proxy). What each may do, the swarm's user
+  [`operations.md`](operations.md), Behind a reverse proxy), or a token from logging in on any node
+  of the swarm (`Authorization: Bearer`, [`access.md`](access.md), Tokens). What each may do, the swarm's user
   registry says, by path ([`access.md`](access.md)): `403` where it doesn't let the user, and
   of a part it may only partly read, a read shows the keys on the way to what it may.
   In a swarm without a registry, users are all alike: each can read and write