examples/session_login.py: the new-visitor login sends its session cookie without Cache-Control: private, no-store

[allen0099]

Problem

In examples/session_login.py, the "new visitor logs in" branch creates the session and calls response.set_cookie itself. The middleware adds Cache-Control: private, no-store only to tokens it sends, so this response goes out without it:

POST /login (new visitor) -> 200
set-cookie: session=...; HttpOnly; Max-Age=1209600; Path=/; SameSite=lax
(no Cache-Control)

A shared cache or CDN could store the response and hand the login to the next visitor.

The same branch also:

• leaves out domain=config.cookie_domain, so with a domain configured, the expiring cookie sent on logout does not match;
• gives header/API clients a cookie but no token.

Proposal

Fix the example: send Cache-Control: private, no-store, pass the configured cookie attributes, and return the token for header clients. #293 would replace this code with a supported login(); until then the example is what people copy.

[allen0099]

#344 fixes the cache headers and cookie attributes. It deliberately does not hand header clients a token from the browser login: a copy of the token in a response header or the body is readable by page scripts, which defeats the HttpOnly cookie. API clients use a token endpoint that returns the token in the body (examples/session_jwt.py). Answering on the request's own transport is left to the login() helper in #293.