fix(api): 删除未接通的 Access JWT 委托，外部面只认会话 cookie，admin 主机的 IP 判定只认安装指定的地址，文档与 OpenAPI 同步

internal/api/handlers_account_sessions.go

@@ -92,8 +92,8 @@ func (a *API) revokeOtherSessionsAfter(r *http.Request, change string) {
 	}
 }
 
-// callerSessionHash is the session the request authenticated with, or "" when it
-// authenticated some other way (a cookie beside an Access JWT names nothing).
+// callerSessionHash is the session the request authenticated with, or "" for a
+// principal that did not come from a session cookie.
 func callerSessionHash(r *http.Request, p *Principal) string {
 	if p == nil || !p.ViaSession {
 		return ""