auth: the session cookie lets in reads only

The cookie lets in GET, HEAD and the session's own requests; anything
changing something brings the token itself, which no page of another
site or port can make a browser send. The dashboard's writes send it.

Auth plan M3 (browsers).

2 files changed, 6 insertions, 2 deletions

diff --git a/docs/access.md b/docs/access.md
index e3dec0b..567cebd 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -128,7 +128,10 @@ no keys (`409`).
 A browser keeps a token as its session: `POST /auth/session`, with a token, answers as
 `/auth/refresh` does and sets a cookie holding the new one (`HttpOnly`,
 `SameSite=Strict`: no script reads it, no other site's page sends it), which lets in
-requests without `Authorization`; `DELETE /auth/session` forgets it. The login page
+requests without `Authorization` that read (`GET`, `HEAD`) or renew or end the session; one
+that changes anything brings the token itself, which no other page, of another site or
+of another port of the same host, can make a browser send. `DELETE /auth/session`
+forgets it. The login page
 (`/login`, without authentication, with the dashboard) begins one by password or from a
 token pasted, from a login by key, say; the dashboard renews it while open
 ([`dashboard.md`](dashboard.md)).
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index bb1d34b..7c8bb84 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -902,7 +902,8 @@ paths:
       description: |
         As `POST /auth/refresh`, and the new token set as the session cookie
         (`continuum-token`, `HttpOnly`, `SameSite=Strict`, for as long as the token is
-        valid): requests without `Authorization` that bring it are its user's.
+        valid): requests without `Authorization` that bring it are its user's, if they
+        read (`GET`, `HEAD`) or renew or end the session; others bring the token themselves.
       security:
         - bearer: []
       requestBody: