Feature-Request: Allow http-get (or other post-less) authentication

I want to integrate the "actions" panel as an iframe into my home automation system (homeassistant). Chimera runs in a http session. If I embed it as an iframe (and it isn't running https) I am not allowed to use POST to authenticate (it's disallowed by the browser). What I would like to do is either disable the password at all or put the password as a GET parameter (or http basic auth, anything I can put in the iframe url) in order to be logged in without another user interaction within that specific iframe.

That would be great.

Start by tracing the actions panel's authentication flow and how it is loaded in an iframe. Decide which post-less mechanism, if any, meets the request without weakening security; done means the selected approach works without another interaction inside the iframe and its behavior is tested.

Written by the indexing model from the issue text.