Fix session token handling and require auth for blog post creation

auth/auth.go

@@ -270,7 +270,7 @@ func GetSession(r *http.Request) (*Session, error) {
 		}
 	}
 
-	// Try Authorization header (PAT or Bearer token)
+	// Try Authorization header (PAT, session token, or Bearer token)
 	authHeader := r.Header.Get("Authorization")
 	if authHeader != "" {
 		// Support both "Bearer <token>" and just "<token>"
@@ -279,14 +279,28 @@ func GetSession(r *http.Request) (*Session, error) {
 			token = authHeader[7:]
 		}
 
+		// Try as PAT first
 		accountID, err := ValidatePAT(token)
 		if err == nil {
-			// Create a pseudo-session for PAT
 			return &Session{
 				Type:    "token",
 				Account: accountID,
 			}, nil
 		}
+
+		// Try as session token (returned by login/signup MCP tools)
+		sess, err := ParseToken(token)
+		if err == nil {
+			mutex.Lock()
+			_, accountExists := accounts[sess.Account]
+			if !accountExists {
+				delete(sessions, sess.ID)
+			}
+			mutex.Unlock()
+			if accountExists {
+				return sess, nil
+			}
+		}
 	}
 
 	// Try X-Micro-Token header (legacy)

blog/blog.go

@@ -1132,22 +1132,21 @@ func PostHandler(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 
-		// Get authenticated user
-		author := "Anonymous"
-		authorID := ""
-		sess, acc, err := auth.RequireSession(r)
-		if err == nil {
-			_ = sess // used for consistency
-			author = acc.Name
-			authorID = acc.ID
-
-			// Check if account can post (30 minute minimum)
-			if !auth.CanPost(acc.ID) {
-				accountAge := time.Since(acc.Created).Round(time.Minute)
-				remaining := (30*time.Minute - time.Since(acc.Created)).Round(time.Minute)
-				app.Forbidden(w, r, fmt.Sprintf("New accounts must wait 30 minutes before posting. Your account is %v old. Please wait %v more.", accountAge, remaining))
-				return
-			}
+		// Require authenticated user
+		_, acc, err := auth.RequireSession(r)
+		if err != nil {
+			app.Unauthorized(w, r)
+			return
+		}
+		author := acc.Name
+		authorID := acc.ID
+
+		// Check if account can post (30 minute minimum)
+		if !auth.CanPost(acc.ID) {
+			accountAge := time.Since(acc.Created).Round(time.Minute)
+			remaining := (30*time.Minute - time.Since(acc.Created)).Round(time.Minute)
+			app.Forbidden(w, r, fmt.Sprintf("New accounts must wait 30 minutes before posting. Your account is %v old. Please wait %v more.", accountAge, remaining))
+			return
 		}
 
 		// Create post