Verify:
- Unauthenticated GET / -> 303 to /login
- Bad-password rejection -> no session is created
- Session cookie is flagged HttpOnly
- Authenticated GET /interfaces -> 200
- with htmx-config meta tag check
- State-changing POST without CSRF token -> 403
- POST with X-CSRF-Token header -> succeeds
- After logout the session no longer grants access
The cookie-preserving WebUI helper class also folds in the IPv6
link-local zone-id workaround (re-encode %25 back to %) that
infamy.restconf already uses.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
