auth: no password prompt over the dashboard's own requests

Opening a dashboard through its login page showed a 401 on /auth/login
and the browser's password prompt. The page asked for its token by the
browser's password first (POST /auth/login), with none to send, and the
401 carried a Basic challenge, which a browser answers with its prompt.

The page now asks by its session first (POST /auth/session), then by
the browser's password or the proxy's. And a 401 to a page's own
requests (Sec-Fetch-Dest: empty: fetch, EventSource) carries no
challenge: a page has its login of its own. Navigations and clients
without the header (curl) are still challenged.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html
index b80e0d2..0f31d7c 100644
--- a/src/api/dashboard/dashboard.html
+++ b/src/api/dashboard/dashboard.html
@@ -2314,10 +2314,10 @@ async function obtainTokens() {
   clearTimeout(tokenTimer);
   try {
     // Refreshed as the session (`POST /auth/session`), whose cookie lets the page in;
-    // the first: by the browser's password or the proxy's, else by that cookie.
+    // the first: by that cookie, else by the browser's password or the proxy's.
     token = token && token.expiresAt > Date.now() + 60000
       ? await tokenCall("../auth/session", token.token)
-      : await tokenCall("../auth/login").catch(() => tokenCall("../auth/session"));
+      : await tokenCall("../auth/session").catch(() => tokenCall("../auth/login"));
     narrowToken = await tokenCall("../auth/refresh", token.token, { limit: READ_MEMBERS });
     tokenWhy = null;
     const life = Math.min(token.expiresAt, narrowToken.expiresAt) - Date.now();