auth - well knowns and small gotchas

[joe-getcouragenow]

The login flow is full of weird little gotchas..

1. Our Flutter GUI does not work with "Suggest Password" in Chrome.

• Well known MIGHT help..
  

2. Verification goes to an URL but down not ask you to login on that same page. SO then any MITM on your email means they can do account takover.

3. Naming and routing for "well knowns" makes it play well with Browsers and password managers. Its become a standard to help the world all get along basically.

For our own Auth System:
Well Known Change Password support
"./well-known/change-password"
https://web.dev/change-password-url/

Same goes for our later OAuth system:
"https://server.com/.well-known/openid-configuration"

https://github.com/fmitra/authenticator

• Good basis for the hardening we will need later
• Demo works well.