[SECURITY] Login protected pages are accessible without a password

[kchristensen]

As I mentioned elsewhere, I noticed that all of the authentication for protected pages is done in javascript, so all it takes to access a protected page is using a client that doesn't support javascript.

The good news is, trying to update your password without a valid JWT fails:

❯ curl -X POST -d json='{user_id: 0, preference_key: "password", preference_value: "testing"}' https://docker.mydomain.com/birdcage/api/preferences
{"msg":"Missing Authorization Header"}

The bad news is, you can view stuff like any MQTT password you have set without a valid JWT:

❯ curl -s https://docker.mydomain.com/birdcage/preferences 2>&1 | grep THIS_IS_A_PASSWORD
            <td><input type="text" name="mqttpassword" value="THIS_IS_A_PASSWORD"></td>

tl;dr it looks like relying on client side JWT validation is insufficient, but I'm not entirely sure what the proper way to do this in Flask is.