WIP authorization token documentation
ws: Create CockpitCreds closer to pam_authenticate()

Create the PAM creds closer to pam_authenticate(), so we can use
the real user that PAM canonicalized, as well as return additional
information into the creds (later).

Remove the noop authorization check. We want to be respecting
system authorization, not inventing our own.
agent: Drop group privileges in cockpit-session

Correctly drop group privileges in cockpit session.

Fix #492
FIXUP CockpitAuth + CockpitCreds closer
WIP remove cockpit_creds_take_password() function
WIP PAM environment
WIP reauthorize