fix: keep the device polling token off the QR code

golem15.user.device_auth.auth_url gains a {short_code} placeholder and
defaults to {frontend_url}/device/scan/{short_code}; POST
/devices/authorize accepts the short code in its token field, so a scan
page that posts what its URL carries keeps working. The status poll hands
the session token over only to a client with the User-Agent the device
initiated with; another client sees the session confirmed and takes
nothing.

config/config.yaml

@@ -45,8 +45,11 @@ frontend_url: ""
 device_auth:
   # The page a new device shows as its QR code, where a signed-in user
   # authorizes it. {frontend_url} is frontend_url (else app.url, no trailing
-  # slash) and {token} the device token.
-  auth_url: "{frontend_url}/device/scan/{token}"
+  # slash), {short_code} the session's short code and {token} the device
+  # token. Keep {token} out of it: the device token is also the secret the
+  # device collects its session token with, and whoever sees the QR code or
+  # the page's URL could take the session.
+  auth_url: "{frontend_url}/device/scan/{short_code}"
   # Minutes a device session can be authorized and handed over.
   ttl_minutes: 5
 backend_links: