fix(auth): stop leaking the token via URL, log and Referer

A token passed as `?token=` was accepted on every route, so it ended
up in the request log (and journald), browser history and Referer.

- drop `?token=` from _check_auth; API and download routes now take
  only the cookie or an Authorization: Bearer header
- keep pre-authenticated links working: on the index route a valid
  `?token=` is swapped for the cookie and redirected to a clean URL,
  so the secret does not linger in the address bar
- redact `token=` from log output
- send Referrer-Policy: no-referrer, and mark the cookie Secure

README.md

@@ -44,6 +44,10 @@ python3 share.py -p 3001 -d ~/Downloads/shared --ttl 7
 Set `token` in `share.config` or pass `--token`. All endpoints require a valid
 token. An empty `token` means open access to everyone on the network.
 
+The token is accepted as an `Authorization: Bearer` header or the `share_token`
+cookie set by the login page. A `?token=` link works only on `/` — it is exchanged
+for the cookie and redirected away so the secret does not linger in the URL.
+
 `share.config` is gitignored because it holds the secret — `share.config.example`
 is the tracked template.