SRP session key is returned to the client over plaintext HTTP #15

[verified]

/srp/verify returns "session_key": base64(fernet_key) derived from the SRP shared secret K. The point of SRP is that both sides derive K independently; sending it back over unencrypted HTTP (#16) hands it to anyone on the path. The client stores it in self.fernet and never uses it.

Fix

• Remove session_key from the response.
• If a per-session key is needed (e.g. for WS authentication in Any participant can impersonate any other user (user_id leaked and used as sole WS credential) #9), have the client derive it from usr.get_session_key().

Related: PR #6 removes session_key from the /srp/verify response.