feat(auth): tell the user when the session expired

Every 401 from Auth or Core now goes through useSessionExpired: the login page
says the session expired and returns to the last page after login. App no
longer removes a token that only the browser clock calls expired, so a backend
401 is the one signal. A 403 on the profile now shows an error instead.

src/utils/auth.js

@@ -24,3 +24,16 @@ export function getValidToken() {
     }
     return token;
 }
+
+/**
+ * Returns the path when it is a path inside this app, else null. The login page uses it to go back after a
+ * session expired; "//host", "/\host" and tabs or line breaks (browsers drop them, so "/\t/host" is "//host")
+ * would leave the app, "/login" would loop.
+ */
+export function safeReturnPath(path) {
+    if (typeof path !== 'string' || !path.startsWith('/') || path.startsWith('//') || path.startsWith('/\\')
+        || /[\t\n\r]/.test(path)) {
+        return null;
+    }
+    return path === '/login' || path.startsWith('/login?') ? null : path;
+}