v0.1.10

Features

• security: The API answers only this run's editor (session key in the printed link)
  Host, Origin and Sec-Fetch-Site stop web pages, but another program on the machine can send
  any header. Each run now makes a session key; the printed link (HTMLDECK_URL=…/?token=)
  hands it to the editor in the address fragment (never sent to a server again, nor in a Referer),
  the editor keeps it in its origin's storage and sends it with every API call (X-HtmlDeck-Key; the
  watch stream, an EventSource, in its query). Not a cookie: a browser sends a cookie of 127.0.0.1
  to every port, so any other local server it calls would get the key. A wrong key gets a page
  saying which link to open; a tab without the key says so. The redirect holding the key is
  no-store and keys never reach the log.

Full Changelog: v0.1.9...v0.1.10