dashboard: tokens renewed after sleep too, never basic authentication

The page renewed its token half way through its life by a timer. A timer fires late
where the computer slept or the tab was in the background, by when the token (and the
session cookie, which lives as long) may have ended: the page then fell back to
`POST /auth/login`, which takes a password the browser keeps (basic authentication),
and without one retried every 30 s, logged out without saying so.

Now whether the token is half way through its life is looked at again when the page
shows and every 30 s (`refreshIfDue`, one renewal at a time), so it is renewed while it
still can be, until the login ends (`--session-lifetime`). Where the login ended, or
there is none (400, 401, 403), the page goes to the login page; a node away is tried
again in 30 s. And the page no longer gets in by a password the browser keeps: only
by its session or through a proxy naming the user (`throughProxy`, `login: "header"`).

The node never challenges a browser for a password either (`WWW-Authenticate`, the
browser's prompt): not only on the dashboard's paths and for a page's own requests, but
for any request with `Sec-Fetch-*` or a `Mozilla/…` user agent. curl sends the password
unasked with `-u`, as before.

1 files changed, 7 insertions, 5 deletions

diff --git a/docs/dashboard.md b/docs/dashboard.md
index da69a16..4973227 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -18,14 +18,16 @@ It is at `/admin/dashboard` on the node's HTTP API, by default
 (`--user-header`) or one logged in on the page `/login`, which a browser opening the
 dashboard without one is sent to. There, a user logs in with its password
 (`--htpasswd`, the same file the API's basic authentication takes, which the dashboard
-never asks for itself: no browser password prompt), or with a token: from `continuum-signed login` (by key,
+never asks for itself, nor takes from the browser: no browser password prompt, the
+node never challenges a browser), or with a token: from `continuum-signed login` (by key,
 [`access.md`](access.md), Tokens), or any other. The page keeps a session for the
 browser, a cookie no script reads and no other site's page sends, renewed while the
-dashboard is open; it ends with the token's lifetime, or with "Log out of this
-browser" on the login page, or "log out" in the user's menu on the dashboard (its
+dashboard is open (half way through the token's life, looked at again when the page
+shows, so after the computer slept too) until the login ends (`--session-lifetime`),
+then back to the login page; it ends with the token's lifetime once not renewed, or
+with "Log out of this browser" on the login page, or "log out" in the user's menu on the dashboard (its
 name, top right), which ends this browser's session only. Where the page got in by
-what it can't end, the browser's password or the proxy's, "log out" is greyed, and
-says how instead. The menu's "credentials…" shows the user's keys, each by its name
+what it can't end, the proxy's, "log out" is greyed, and says how instead. The menu's "credentials…" shows the user's keys, each by its name
 and as much of the key as fits the dialog, cut in the middle where it doesn't (its end
 and comment always shown, the whole in its tooltip), and `edit` at the right: its name
 and `.pub` line in fields, to save, or to delete with the red `Delete` (on a second