2980a441

By: Michael Lynch <git@mtlynch.io>

Simplify shared-secret auth plumbing

Move session cleanup out of handlers.New so the server constructor only takes request-time dependencies. Replace the extra auth_users table and session creation transaction with a single auth_sessions table, and let the session manager own expiration checks through its injected clock.

Use direct password-hash verification for the shared secret instead of adapting simpleauth's username/password store interface.

Timeline