Chore: Strip JWT from URL once authenticated

[nelsonic]

As noted in dwyl/auth#268 the JWT for a successfully authentication session remains in the URL:

This is undesirable because if there was a malicious <link> on the page
or someone loaded an <img> on the page that made an outbound HTTP Request,
the JWT would be in the referrer header of the request
and thus the session could be compromised.
i.e. a malicious actor could just extract the JWT from their logs
and replay it to gain access to everything the person has saved in the dwyl App.

Note: this is not an "active exploit". We are still testing our MVP.
Nobody has stored any personal/private/important data in the MVP
and there has not been any indication of anyone malicious attempting to "steal" a JWT.
I am opening this issue proactively to resolve this before it becomes an exploit.

Todo

• Strip jwt from URL once the session has been established.

Note: this will be rolled into the V2 update "Coming Soon" ... 🔜
So please ignore it until then. 👌