EasyWAF v0.8.0

Added

• Accounts have roles: admin sees and changes everything, viewer sees the
  dashboard, traffic, sites, policies, rules, exclusions and certificates but
  changes nothing. Every account existing before the upgrade becomes an admin.
• Account management under Settings › Accounts: create, change role, reset a
  password, sign out everywhere, suspend, delete.
• Accounts can be suspended rather than deleted, keeping their history, and
  their last sign-in is recorded.
• Sessions can be ended. A password change, role change, suspension or "sign
  out everywhere" invalidates that account's sessions immediately, instead of
  leaving them valid for up to eight hours.
• The interface reflects the role: controls a viewer cannot use are not offered,
  and the header shows a viewer badge.

Changed

• Authorisation is declared per route rather than checked by each handler, so a
  page that needs an administrator cannot be written without saying so.
• Settings is administrator-only. Certificates are readable by viewers —
  private keys are never rendered — but uploading, requesting and deleting are
  not.

Security

• A session no longer outlives the password that created it.
• No action can leave the installation without an enabled administrator: the
  last one cannot be demoted, suspended or deleted, and no account can suspend
  or delete itself.

Commits

• 81765eb Point prune-debris at where the database actually is — yarivha
• f1329c3 Put proxy performance on the roadmap at 0.10.0 — yarivha
• c8e7339 Give accounts roles, and make a session endable — yarivha
• 20e2cd3 Convert every handler to a declared authorisation requirement — yarivha
• 7dcd829 Add account management, guarded against locking everyone out — yarivha
• 01a988c Show a viewer only what a viewer can do — yarivha
• 3615997 Let a viewer read certificates — yarivha
• c7e0c1d Let an account change its own password — yarivha

Full changelog: v0.7.3...v0.8.0