Allow bypass one-time token authentication

[zhming0]

Hi there 👋🏿 👋🏿 , we noticed that in v0.1.2-rc.1, a one-time token authentication mechanism was added.

I fully understand the security rationale, thank you!

But can I ask for a way to opt-out this? We deploy DSH in a safe environment where we put a front proxy to authenticate incoming requests with our own mechanism. The one-time token mechanism is a blocker for us to upgrade 🙏🏿 🙏🏿 (I mean, we can build a workaround but still want to raise this feedback, thanks!)

---

(Please advise if you prefer me to use Chinese)

cc @tianyicui

[lucas-farias07]

I also have it on my home server and the token is genuinely annoying me, hope they add a way to opt-out

[quark-zju]

I'd like this too (plus changes to other places to relax "localhost" check). For reference, my current own self-host solution is briefly noted here.