"cmd/principal": No third-party code on Macaroon receiving page
"cmd/principal": No third-party code on Macaroon receiving page

A bugcrowd researcher recently reported an attack wherein an
attacker can steal macaroons by carrying out a MITM attack on
the CSS fetching done by our macaroon-receiver page.

See: https://github.com/veyron/release-issues/issues/2033

The macaroon-receiver page runs on http://localhost and the CSS
is fetched over HTTP as well. As a result using a MITM attack on
the CSS fetching, an attacker can get hold of the URL of the page
via the referrer header and therefore the macaroon embedded in the
URL. The macaroon can then be used by the attacker to obtain a
blessing for himself under the identity encapsulated in the
macaroon, thus carrying out an impersonation attack.

While there are a number of ways to fix this attack -- fetching
the CSS over HTTPS, or, redirecting the macaroon-receiver page to one
that does not have the macaroon embedded in the URL, or getting
rid of the CSS entirely.

This CL goes with the third fix mentioned above. The macaroon-receiver
page is one of the most security-critical pages in our seek-blessings
flow. Therefore, it is risky to have *any* third-party code on this
page. By not having any third-party code, and not making any external
requests, we eliminate the risk of leaking any data out from the
macaroon-receiver page.

This CL gets rid of the link to the stylesheet, and instead inlines some
style attributes on the various HTML tags.

Change-Id: I4dc1429b194de79b761020ccf38242eafb95bd18

vanadium/go.ref,vanadium/go.ref,vanadium/go.ref,vanadium/go.ref,vanadium/go.ref,vanadium/go.ref