Support Forms Authentication about pylon

[exsilium]

Pylon connect middleware has the following hooks that are used by different server side plugins to layer the connectivity based on role:

• Start
  • connect
  • pylon.alive
  • pylon.core
  • pylon.debug
• Setup
  • connect
  • pylon.connect.basic-auth
• Main
  • connect.static
• Session
  • connect.session
  • pylon.permissions
  • pylon.core
  • pylon.connect.form-auth` - This is new plugin for auth
• Auth
  • pylon.fs
  • pylon.core
• Error - Not Used

Because the form-auth differs from basic authentication and we need the session data - the authentication is performed at a later stage, exposing the static resources of the platform.

Either,

1. treat this as a non-issue - static content exposure really isn't an issue for an OSS solution;
2. move connect.static to use the session hook. Downside of this is the session validation for all the static content, which is nonoptimal;