users need always login

scribblings/rkt-web-player.scrbl

@@ -21,9 +21,8 @@ browser by Racket's web server.
                                      (list/c string? path-string?)))]
           [#:allowed-agent-ids allowed-agent-ids (listof string?) null]
           [#:users users (listof (cons/c string? string?)) null]
-          [#:local-networks local-networks (listof string?)]
           [#:trusted-proxies trusted-proxies (listof string?)]
-          [#:session-seconds session-seconds exact-positive-integer? 43200]
+          [#:session-seconds session-seconds exact-positive-integer? 604800]
           [#:listen-ip listen-ip string? "127.0.0.1"]
           [#:port port exact-positive-integer? 8080]
           [#:dlna-port dlna-port exact-positive-integer? 8734]
@@ -45,6 +44,10 @@ network renderer. Playlist tabs are atomically persisted in
 resources are closed when the web server exits. The default is
 @tt{data/playlists.keystore} below the installed rkt-web-player collection.
 Each username owns an ordered GUID index and separate playlist values.
+When @racket[users] is non-empty, every browser client must authenticate.
+Sessions have a sliding idle timeout; an active browser cookie is renewed once
+half of @racket[session-seconds] has elapsed. Playback-agent endpoints continue
+to use their separate application-ID allowlist.
 
 The default listen address only exposes the interface to the local computer.
 Use a LAN address deliberately if other devices should control the player.