dashboard: going to another node's dashboard without its login page in between

Going to another member's dashboard showed its login page for a moment: a browser
without a session there was sent from `/admin/dashboard` to `/login` (by
`auth::basic_auth`), which began a session with the token handed over and went on to
the dashboard.

Now the dashboard's page is served without authentication, as the login page is (it
holds nothing: what it shows it reads with the browser's session). Opened with a token
handed over, the page begins the session with it (`POST /auth/session`) before it reads
anything; without a session, `obtainTokens` goes to the login page, as the redirect
did. A request without credentials is refused at once rather than after the 1.5 s
that slow down guessing passwords: nothing is guessed there, and a page without a
session goes to the login page without waiting twice for it.

1 files changed, 13 insertions, 1 deletions

diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html
index d32fa7a..dd37f29 100644
--- a/src/api/dashboard/dashboard.html
+++ b/src/api/dashboard/dashboard.html
@@ -4374,7 +4374,19 @@ remakeForm.addEventListener("submit", event => {
     .catch(error => remakeResult("Proposing failed: " + error, true));
 });
 
-connect();
+// Opened from another member's page (`handOver`) with a token: it begins this browser's
+// session here before anything is read, with no login page in between. Without a
+// session, `obtainTokens` goes to the login page.
+(async () => {
+  if (handOver && typeof handOver.token === "string") {
+    try {
+      await tokenCall("../auth/session", handOver.token);
+    } catch (_) { /* a session of this browser's own may let it in still */ }
+    delete handOver.token;
+  }
+  connect();
+  obtainTokens();
+})();
 // A page not shown (another tab, a minimised window) is paused: hidden for a while, it
 // closes its stream, so the node stops building updates and asking members for their
 // links for it; shown again, it reconnects. Briefly hidden, nothing changes.