A separate copy of server-angular.js (the production server is unchanged): refuses to start without a per-run secret or in
production, listens on 127.0.0.1 only (page and program callback port), no PAM/setuid - registry programs run as the server's user,
and /auth/login accepts only the secret. The login page signs in by itself from /login?autologin=1&program=..&secret=.. when the
server says it is a developer server. Tests: tools/dev-server-test.js (incl. a real browser). See docs/web_ui_dev_server.txt.