VaultSync console
-----------------
GET  /token   -> a guest session token (hex of IV || ciphertext, AES-CBC).
POST /login   -> body = a session token.