fix: require POST for user block/unblock and OTP email, flag console cookie

- user_block, user_unblock and admin_email_otp changed state on GET, so an
  <img> tag could lock a user out or trigger OTP emails through an
  admin's session. They now require POST; the buttons are CSRF forms.
- The console token cookie is set with httponly, SameSite=Lax and, on
  HTTPS, secure. Only novncd reads it; the page gets the token directly.

console/tests.py

@@ -175,6 +175,21 @@ class ConsoleViewsTestCase(TestCase):
         self.assertEqual(response.status_code, 403)
         self.assertIn("permission", response.content.decode("utf-8").lower())
 
+    @patch("console.views.wvmInstance")
+    def test_console_token_cookie_flags(self, mock_wvm):
+        # ROADMAP S-11: the token cookie is only read by novncd, never by JS.
+        mock_conn = MagicMock()
+        mock_conn.get_console_type.return_value = "vnc"
+        mock_conn.get_console_websocket_port.return_value = None
+        mock_wvm.return_value = mock_conn
+
+        self.client.force_login(self.admin_user)
+        response = self.client.get(reverse("console") + f"?token={self.token}")
+
+        cookie = response.cookies["token"]
+        self.assertTrue(cookie["httponly"])
+        self.assertEqual(cookie["samesite"], "Lax")
+
     @patch("console.views.wvmInstance")
     def test_console_view_instances_perm_does_not_open_console(self, mock_wvm):
         # ROADMAP S-09: global view_instances is a read-only role; the console

console/views.py

@@ -166,5 +166,8 @@ def console(request):
             }
         response = render(request, "console-vnc-lite.html", locals())
 
-    response.set_cookie("token", token)
+    # Only novncd reads this cookie; JavaScript gets the token from the page.
+    response.set_cookie(
+        "token", token, httponly=True, samesite="Lax", secure=request.is_secure()
+    )
     return response