Browser support for server authentication/authorization

Browser exposes authentication and uses authorization if needed. Set of new :server commands are now available, along with documentation for such.
Webadmin redirects to browser for authentication.
It comes from the $parent scope (the Auth Controller) when the server forces the user to change password.

You have a valid concern, if someone leaves their browser unattended before setting a new password, someone could use the console to get the current password. But it's no good since the user needs to change it before getting a authorization token.  
And this is just at the very first login using the default username and password.
When changing the password at some other moment, both the current and new password are asked for.