unlink convoy unless logged in

honk.go

@@ -1374,7 +1374,6 @@ func serve() {
 	getters.HandleFunc("/u/{name:[[:alnum:]]+}/followers", emptiness)
 	getters.HandleFunc("/u/{name:[[:alnum:]]+}/following", emptiness)
 	getters.HandleFunc("/a", avatate)
-	getters.HandleFunc("/t", showconvoy)
 	getters.HandleFunc("/d/{xid:[[:alnum:].]+}", servefile)
 	getters.HandleFunc("/emu/{xid:[[:alnum:]_.-]+}", serveemu)
 	getters.HandleFunc("/meme/{xid:[[:alnum:]_.-]+}", servememe)
@@ -1405,6 +1404,7 @@ func serve() {
 	loggedin.HandleFunc("/h", showhonker)
 	loggedin.HandleFunc("/c/{name:[[:alnum:]]+}", showcombo)
 	loggedin.HandleFunc("/c", showcombos)
+	loggedin.HandleFunc("/t", showconvoy)
 	loggedin.Handle("/savehonker", login.CSRFWrap("savehonker", http.HandlerFunc(savehonker)))
 
 	err = http.Serve(listener, mux)

views/honk.html

@@ -1,4 +1,5 @@
 <article class="honk {{ .Honk.What }} {{ and (not .Honk.Public) "limited" }}" data-convoy="{{ .Honk.Convoy }}">
+{{ $bonkcsrf := .BonkCSRF }}
 {{ with .Honk }}
 <header>
 <img alt="avatar" src="/a?a={{ .Honker}}">
@@ -17,9 +18,11 @@ in reply to: <a href="{{ .RID }}" rel=noreferrer>{{ .RID }}</a>
 {{ end }}
 {{ end }}
 <br>
-<span style="margin-left: 1em;" class="clip">
-convoy: <a href="/t?c={{ .Convoy }}">{{ .Convoy }}</a>
-</span>
+{{ if $bonkcsrf }}
+<span style="margin-left: 1em;" class="clip">convoy: <a href="/t?c={{ .Convoy }}">{{ .Convoy }}</a></span>
+{{ else }}
+<span style="margin-left: 1em;" class="clip">convoy: {{ .Convoy }}</span>
+{{ end }}
 </header>
 <div class="noise">
 <p>{{ .HTML }}
@@ -44,7 +47,7 @@ convoy: <a href="/t?c={{ .Convoy }}">{{ .Convoy }}</a>
 {{ end }}
 </div>
 {{ end }}
-{{ if .BonkCSRF }}
+{{ if $bonkcsrf }}
 <p>
 <details>
 <summary>Actions