Admin auth with JWT

[pieroit]

Admin is served from core only to authenticated users. When the admin loads up, there is a Cookie header with ccat_user_token=xxx

Flow:

• at startup, get the cookie value. If there is no cookie, do everything as usual.
• for http requests, use the header:
  • Authorization: Bearer xxx
• for ws connection, use the url query param:
  • ws://<cat-url-and-port>/ws/?token=xxx

User info:

• user info can be obtained by decoding the JWT
• (show username)

Notes:

• it may be hard to pass the JWT to the admin in dev version

Later issues:

• hide selectively pages according to permissions
• for another issue, when core supports refresh token, refresh it