auth: a login page and browser sessions

GET /login without authentication: log in by password or with a token
(from a login by key). POST/DELETE /auth/session keep the token as an
HttpOnly, SameSite=Strict cookie; the dashboard sends a browser
without a user there and renews the session while open.

Auth plan M2/M3 (browsers).

1 files changed, 8 insertions, 2 deletions

diff --git a/docs/dashboard.md b/docs/dashboard.md
index 05069d1..df2d4f9 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -14,8 +14,14 @@ cargo build --release --features mycelium,dashboard
 ```
 
 It is at `/admin/dashboard` on the node's HTTP API, by default
-`http://127.0.0.1:3000/admin/dashboard`, and asks for a user from `--htpasswd` (or one
-a reverse proxy names, `--user-header`), as the rest of the API does. The API listens on localhost unless `--bind-addr` says otherwise;
+`http://127.0.0.1:3000/admin/dashboard`, for a user a reverse proxy names
+(`--user-header`) or one logged in on the page `/login`, which a browser opening the
+dashboard without one is sent to. There, a user logs in with its password
+(`--htpasswd`), or with a token: from `continuum-signed login` (by key,
+[`access.md`](access.md), Tokens), or any other. The page keeps a session for the
+browser, a cookie no script reads and no other site's page sends, renewed while the
+dashboard is open; it ends with the token's lifetime, or with "Log out of this
+browser". The API listens on localhost unless `--bind-addr` says otherwise;
 to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000
 <machine>`) or put a TLS proxy in front ([`operations.md`](operations.md), Behind a reverse proxy).