Browser support for server authentication/authorization

Browser exposes authentication and uses authorization if needed. Set of new :server commands are now available, along with documentation for such.
Webadmin redirects to browser for authentication.
It's not clear to me where `current_password` comes from. I'm guessing it's just for repeating back the password previously entered as part of the same password reset attempt. However, I just want to be sure that there's no state transfer possible between consecutive password reset attempts, such that a malicious user could extract a password in plain that was entered by a user who left their browser unattended.