Phase 1a: browser-side security

- Provider-controlled strings (channel names, groups, file names, log
  lines, in-place mapping edits, client info) are rendered with
  textContent instead of innerHTML. PopupContent.description() takes an
  explicit isHTML flag that only the static help texts pass.
- Websocket: drop the always-true CheckOrigin so gorilla's same-origin
  check applies; read the session token from the HttpOnly cookie sent with
  the handshake (the ?Token= query parameter is still accepted for older
  clients); the client no longer puts the token in the URL, rewrites the
  cookie, or console-logs request/response payloads.
- Session cookie is HttpOnly, SameSite=Strict, Path=/, session-scoped
  (expiry stays server side) and is cleared on logout.
- Serving the first-run wizard no longer sets Settings.AuthenticationWEB
  to false; the wizard page simply bypasses login while it is active.
- Upgrade failures no longer write a second error response.
- Tests: src/websocket_test.go covers cross-origin refusal, same-origin
  and no-Origin clients, missing/unknown/legacy tokens, and cookie flags.

ts/network_ts.ts

@@ -14,7 +14,6 @@ class Server {
 
     SERVER_CONNECTION = true
     
-    console.log(data)
     if (this.cmd != "updateLog") {
       showElement("loading", true)
       UNDO = new Object()
@@ -34,7 +33,8 @@ class Server {
     if (wsHost == undefined || wsHost.length < 1) {
       wsHost = window.location.hostname
     }
-    var url = this.protocol + wsHost + "/data/" + "?Token=" + getCookie("Token")
+    // The session cookie (HttpOnly) is sent with the websocket handshake.
+    var url = this.protocol + wsHost + "/data/"
 
     data["cmd"] = this.cmd
     var requestCmd:string = data["cmd"]
@@ -92,12 +92,6 @@ class Server {
         setConnectionState("busy")
       }
 
-      console.log("REQUEST (JS):");
-      console.log(data)
-
-      console.log("REQUEST: (JSON)");
-      console.log(JSON.stringify(data))
-
       this.send(JSON.stringify(data));
       
     }
@@ -122,14 +116,7 @@ class Server {
       responseReceived = true
       finishRequest("online", true)
 
-      console.log("RESPONSE:");
       var response = JSON.parse(e.data);
-  
-      console.log(response);
-
-      if (response.hasOwnProperty("token")) {
-        document.cookie = "Token=" + response["token"]
-      }
 
       if (response["status"] == false) {
         setConnectionState("offline")
@@ -213,8 +200,3 @@ class Server {
 
 var WS_FAILURE_COUNT:number = 0
 
-function getCookie(name) {
-  var value = "; " + document.cookie;
-  var parts = value.split("; " + name + "=");
-  if (parts.length == 2) return parts.pop().split(";").shift();
-}