Add read:self and cancel:self to sessions; add dev unpriv user (#923)

* Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed.

* Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing.

* Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.

internal/tests/api/authmethods/authenticate_test.go

@@ -13,22 +13,17 @@ import (
 
 func TestAuthenticate(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
-	amId := "ampw_1234567890"
-	tc := controller.NewTestController(t, &controller.TestControllerOpts{
-		DefaultAuthMethodId: amId,
-		DefaultLoginName:    "user",
-		DefaultPassword:     "passpass",
-	})
+	tc := controller.NewTestController(t, nil)
 	defer tc.Shutdown()
 
 	client := tc.Client()
 	methods := authmethods.NewClient(client)
 
-	tok, err := methods.Authenticate(tc.Context(), amId, map[string]interface{}{"login_name": "user", "password": "passpass"})
+	tok, err := methods.Authenticate(tc.Context(), tc.Server().DevAuthMethodId, map[string]interface{}{"login_name": "user", "password": "passpass"})
 	require.NoError(err)
 	assert.NotNil(tok)
 
-	_, err = methods.Authenticate(tc.Context(), amId, map[string]interface{}{"login_name": "user", "password": "wrong"})
+	_, err = methods.Authenticate(tc.Context(), tc.Server().DevAuthMethodId, map[string]interface{}{"login_name": "user", "password": "wrong"})
 	require.Error(err)
 	apiErr := api.AsServerError(err)
 	require.NotNil(apiErr)