Prevent login loops when the WebUI is protected by HTTP authentication
at a reverse proxy. Apply the fix to settings, uploads, and live streams
while retaining compatibility with existing WebUI clients.
Fixes#523
Bound unauthenticated sign-in requests and require active sessions for browser-served account images.
Keep live updates authenticated without exposing session material in request URLs, and apply conservative response protections without restricting existing WebUI assets.