An HttpOnly, SameSite=Lax session cookie is issued when a job is
created. Job and snapshot routes return 404 to any other session, so
indexed source is only readable by the browser that loaded it.
Implements the API routes (jobs, progress events, snapshots, search,
entities, source delivery with release) to net/http and serves the
static frontend from the same binary on the same origin.
Andy Dixon