2 files changed, 5 insertions, 5 deletions
diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html
index d01639e..b80e0d2 100644
--- a/src/api/dashboard/dashboard.html
+++ b/src/api/dashboard/dashboard.html
@@ -2078,8 +2078,9 @@ function handOff(id, handed) {
     legend: !document.getElementById("legends").hidden,
     figures: [...open],
     document: [...documentOpen],
-    // A token reading only, for five minutes: the other node's login page begins a
-    // session with it (`login.html`), where the browser has none there.
+    // A token reading the member list only, for five minutes, enough for the map: the
+    // other node's login page begins a session with it (`login.html`), where the
+    // browser has none there. Whoever publishes the dashboard gets it: no more.
     token: handed || undefined,
   }));
 }
@@ -2451,7 +2452,6 @@ addEventListener("keydown", event => {
 // opened in this page; else its halo flashes red, larger than usual, and "no dashboard"
 // rises from it in the same red, both fading out. This node's own: here already.
 const FLASH_MS = 1200;
-const READ_ALL = [{ path: [], rights: ["read"] }, { path: ["_continuum"], rights: ["read"] }];
 async function openDashboard(id) {
   const member = state.graph.members[id];
   if (!member || member.self) return;
@@ -2460,7 +2460,7 @@ async function openDashboard(id) {
     if (token) {
       try {
         handed = (await tokenCall("../auth/refresh", token.token,
-          { limit: READ_ALL, lifetime: 300 })).token;
+          { limit: READ_MEMBERS, lifetime: 300 })).token;
       } catch (_) { /* the other dashboard asks for a login then */ }
     }
     location.assign(member.dashboard.split("#")[0] + handOff(id, handed));
diff --git a/src/api/dashboard/login.html b/src/api/dashboard/login.html
index e09d31c..74c9fd1 100644
--- a/src/api/dashboard/login.html
+++ b/src/api/dashboard/login.html
@@ -74,7 +74,7 @@ document.getElementById("token").addEventListener("submit", async event => {
   try { await begin(event.target.token.value.trim()); } catch (error) { failed(error); }
 });
 // Opened from another member's dashboard (`handOff`), sent here for want of a session:
-// its token, reading only, begins one; the rest goes on to the dashboard.
+// its token, reading the member list only, begins one; the rest goes on to the dashboard.
 (async () => {
   const HAND_OFF = "#continuum=";
   if (!location.hash.startsWith(HAND_OFF)) return;