Browser extension sign-in limited further

Changed the browser extension's sign-in so it can only read the encrypted Password Vault, add a login, update one login and sign out. It can no longer replace the vault's password or recovery key or delete records. The sign-in code now travels in the address fragment, the connect page asks you to continue only if you just chose Sign in in the extension, and the extension checks the page again before filling. These changes followed a security review of the extension, which is still in development.