dashboard: tokens renewed after sleep too, never basic authentication

The page renewed its token half way through its life by a timer. A timer fires late
where the computer slept or the tab was in the background, by when the token (and the
session cookie, which lives as long) may have ended: the page then fell back to
`POST /auth/login`, which takes a password the browser keeps (basic authentication),
and without one retried every 30 s, logged out without saying so.

Now whether the token is half way through its life is looked at again when the page
shows and every 30 s (`refreshIfDue`, one renewal at a time), so it is renewed while it
still can be, until the login ends (`--session-lifetime`). Where the login ended, or
there is none (400, 401, 403), the page goes to the login page; a node away is tried
again in 30 s. And the page no longer gets in by a password the browser keeps: only
by its session or through a proxy naming the user (`throughProxy`, `login: "header"`).

The node never challenges a browser for a password either (`WWW-Authenticate`, the
browser's prompt): not only on the dashboard's paths and for a page's own requests, but
for any request with `Sec-Fetch-*` or a `Mozilla/…` user agent. curl sends the password
unasked with `-u`, as before.

0 files changed, 0 insertions, 0 deletions