Add token-based auth for WebDAV/NTLM and API access

- Add Token model with CRUD endpoints (/api/tokens, /auth/tokens)
- Support Basic auth with token:<secret> for built-in users
- Implement full NTLMv2 handshake for Windows WebDAV clients
- Add SSO token auth via check_permissions() proxy
- Hydrate request auth context from session or Authorization header
- Persist session cookie after successful Authorization-based login
- Add secure flag to session cookies based on request scheme
- Add frontend UserTokensModal for creating/revoking tokens
- Fix devserver to run workspace source via python -m cista
- Add tests for token CRUD and file auth (Basic, NTLM, session)
- Remove proactive WWW-Authenticate advertisement

cista/session.py

@@ -19,21 +19,21 @@ def get(request):
         return False if "s" in request.cookies else None
 
 
-def create(res, username, **kwargs):
+def create(res, username, *, secure: bool = True, **kwargs):
     data = {
         "exp": int(time()) + max_age,
         "username": username,
         **kwargs,
     }
     s = jwt.encode(data, session_secret())
-    res.cookies.add_cookie("s", s, httponly=True, max_age=max_age)
+    res.cookies.add_cookie("s", s, httponly=True, max_age=max_age, secure=secure)
 
 
-def update(res, s, **kwargs):
+def update(res, s, *, secure: bool = True, **kwargs):
     s.update(kwargs)
     s = jwt.encode(s, session_secret())
     max_age = max(1, s["exp"] - int(time()))  # type: ignore
-    res.cookies.add_cookie("s", s, httponly=True, max_age=max_age)
+    res.cookies.add_cookie("s", s, httponly=True, max_age=max_age, secure=secure)
 
 
 def delete(res):