fix(web): start a fresh session at login

SetLoginUser added the user to whatever session the login request
carried, so its CSRF token outlived the login. Anyone can fetch an
anonymous session with its token, and a host on a sibling domain can
plant that cookie in the admin's browser. Clear the session before the
user is stored; the next page load or token fetch mints a new token.

internal/web/session/session.go

@@ -29,6 +29,9 @@ func SetLoginUser(c *gin.Context, user *model.User) error {
 		return nil
 	}
 	s := sessions.Default(c)
+	// Anyone can mint the anonymous session this request carried and plant it in a browser,
+	// so nothing in it, the CSRF token above all, outlives the privilege change.
+	s.Clear()
 	s.Set(loginUserKey, user.Id)
 	s.Set(loginEpochKey, user.LoginEpoch)
 	return s.Save()